How to Configure Syslog Purging Interval for MAS

Syslog is a standard protocol for logging. It has two components: the Syslog auditing module, which runs on the NetScaler instance, and the Syslog server, which can run either on the underlying FreeBSD operating system (OS) of the NetScaler instance or on a remote system. SYSLOG uses User Datagram Protocol (UDP) for data transfer.

Syslog enables isolation of the system that generates information and the system that stores the information. You can consolidate logging information and derive insights from the collected data. You can also configure syslog to log different types of events.

To limit the amount of syslog data stored in the database, you can specify the interval at which you want to purge syslog data.  You can specify the number of days after which the following syslog data will be deleted from NetScaler MAS:

• Generic Syslog Data

• AppFirewall Data

• NetScaler Gateway Data

You can also configure the NetScaler Gateway purge interval by syslog type. This purge interval takes precedence over the purge interval configured to retain NetScaler Gateway data.

To configure syslog purge interval settings for MAS:

1. Navigate to System > System Administration. Under Instance Settings, click Syslog Purge Settings.

2. In Configure Syslog Purge Settings page, enter the following details:

   • Retain Syslog Generic Data -  Specify the number of days for which NetScaler MAS retains generic syslog messages.

   • Retain AppFirewall Data – Specify the number of days for which NetScaler MAS retains AppFirewall syslog messages.

   • Retain NetScaler Gateway Data – Specify the number of days for which NetScaler MAS retains NetScaler Gateway syslog messages.

3. Select the Configure NetScaler Gateway Purge Interval by Syslog Type checkbox if you want this to take precedence over the purge settings interval configured to retain the NetScaler Gateway data.

4. Select one or more of the following options:

   • Type - The type of NetScaler Gateway syslog types generated on the devices, such as Login, Logout, Login failed, ICA proxy session start, and others. Select the type for which you want syslog data deleted from the NetScaler MAS server.

   • Purge Interval (Days) - The time interval between two successive purge operations performed on syslog data.

5. Click OK.