Auditing authenticated sessions

You can configure the NetScaler appliance to keep a log of all the events that are triggered in an authenticated session. Using this information, you can audit state and status information, to see the history for users in chronological order.

To do this, define an audit policy that specifies the following:

  • Log type. The logs can be stored remotely (syslog) or locally on the NetScaler appliance (nslog).
  • Rule. The conditions on which the logs are stored.
  • Action. Details of the log server and other details for creating the log entries.

This audit policy can be configured at different levels: user-level, group-level, AAA virtual server, and global system level. The policies configured at the user-level have the highest priority.

Note

This topic details steps for using syslog. Make necessary changes to use nslog.

To configure syslog auditing by using the CLI

  1. Configure the audit server with the relevant log settings.

    ns-cli-prompt> add audit syslogAction <name> <serverIP> …

  2. Configure the audit policy by associating the audit server.

    ns-cli-promptadd audit syslogPolicy <name> <rule> <action>

  3. Associate the audit policy with one of the following entities:

    • Bind the policy to a specific user.

      ns-cli-promptbind aaa user <userName>-policy <policyname> …

    • Bind the policy to a specific group.

      ns-cli-promptbind aaa group <groupName>-policy <policyname> …

    • Bind the policy to a AAA virtual server.

      ns-cli-prompt> bind authentication vserver <name> -policy <policyname> …

    • Bind the policy globally to the NetScaler appliance.

      ns-cli-prompt> bind tm global -policyName <policyname> …

To configure syslog auditing by using the GUI (Configuration tab)

  1. Configure the audit server and policy.

    Navigate to Security > AAA - Application Traffic > Policies > Auditing > Syslog, and configure the server and the policy in the relevant tabs.

  2. Associate the policy with one of the following:

    • Bind the policy to a specific user.

      Navigate to Security > AAA - Application Traffic > Users, and associate the authorization policy with the relevant user.

    • Bind the policy to a specific group.

      Navigate to Security > AAA - Application Traffic > Groups, and associate the authorization policy with the relevant group.

    • Bind the policy to a AAA virtual server.

      Navigate to Security > AAA - Application Traffic > Virtual Servers, and associate the authorization policy with the relevant virtual server.

    • Bind the policy globally to the NetScaler appliance.

      Navigate to Security > AAA - Application Traffic > Policies > Auditing > Syslog or Nslog, select the authorization policy, and click Action > Global Bindings to bind the policy globally.

Auditing authenticated sessions