Citrix NetScaler Administration Guide
audserver
Customizing Logging on the NSLOG Server
You can customize logging on the NSLOG server by making additional modifications to the NSLOG server configuration file (log.conf). Use a text editor to modify the log.conf configuration file on the server system.
To customize logging, use the configuration file to define filters and log properties.
wLog filters. Filter log information from a NetScaler appliance or a set of NetScaler appliances.
wLog properties. Each filter has an associated set of log properties. Log properties define how to store the filtered log information.
Creating Filters
You can use the default filter definition located in the configuration file (audit log.conf ), or you can modify the filter or create a new filter. You can create more than one log filter.
Note: For consolidated logging, if a log transaction occurs for which there is no filter definition, the default filter is used (if it is enabled.) The only way you can configure consolidated logging of all the Citrix NetScaler appliances is by defining the default filter.
To create a filter
At the command prompt, type the following command in the configuration file
(auditlog.conf) :
filter <filterName> [IP <ip>] [NETMASK <mask>] [ON OFF]
<filterName>: Specify the name of the filter (maximum of 64 alphanumeric characters).
<ip>: Specify the IP addresses.
<mask>: Specify the subnet mask to be used on a subnet.
Specify ON to enable the filter to log transactions, or specify OFF to disable the filter. If no argument is specified, the filter is ON
Examples
filter F1 IP 192.168.100.151 ON
To apply the filter F2 to IP addresses 192.250.100.1 to 192.250.100.254:
filter F2 IP 192.250.100.0 NETMASK 255.255.255.0 ON
89
