View auditing information

Syslog is a standard protocol for logging. It has two components: the Syslog auditing module, which runs on the NetScaler instance, and the Syslog server, which can run either on the underlying FreeBSD operating system (OS) of the NetScaler instance or on a remote system. SYSLOG uses User Datagram Protocol (UDP) for data transfer.

Syslog enables isolation of the system that generates information and the system that stores the information. You can consolidate logging information and derive insights from the collected data. You can also configure syslog to log different types of events.

You can monitor the syslog messages that a NetScaler device generates if you configure the device to redirect syslog messages to NetScaler MAS. You can schedule a job to create syslog servers that generate different kinds of syslog data using the buit-in templates feature in NetScaler MAS.

First, configure a syslog server to which the instance can send log information. Then, specify the date and time format for recording log messages.

To configure a syslog server on NetScaler MAS:

  1. Navigate to System > Auditing. Under Configuration Summary, select Syslog Servers. Or you can navigate to System > Auditing > Syslog Servers.
  2. In the Syslog Server page, click Add.
  3. On the Create Syslog Server page, enter the following values:
    • Name - Name for the syslog server.
    • IP Address - IP address of the syslog server.
    • Port - Syslog server port.
  4. Choose the log levels (All, None, or Custom). Accordingly, select the severity levels.
  5. Click Create.

To configure the syslog date and time format on NetScaler MAS:

  1. Navigate to System > Auditing. Under Configuration Summary, select Syslog Servers.
  2. In the Syslog Server page, select a syslog server, and then, click Syslog Parameters.
  3. On the Configure Syslog Parameters page, specify the date and time format.
  4. Click OK.

To view syslog messages on NetScaler MAS:

You can now view all your syslog messages generated on your managed NetScaler instances if you have configured your instance to redirect the syslog messages to the NetScaler MAS server. The syslog messages are stored in the NetScaler MAS server’s database centrally and will make them available on the Syslog Viewer for auditing purposes. You can consolidate this logging information and derive reports for analytics from the collected data.

You can filter this information by module, event type, and severity. You can also configure syslog to log different types of events.

To view the Syslog Viewer, navigate to System > Auditing. In the Auditing page, under Audit Messages, select Syslog Messages. Choose the appropriate filters, to view your system log messages.

localized image

View auditing information

In this article