Product Documentation

nstrace

Sep 02, 2016

Configuration for nstrace operations resource.

Properties (click to see Operations)

Name Data Type Permissions Description
nf
<Double>
Read-write
Number of files to be generated in cycle.
Default value: 24
Minimum value = 1
Maximum value = 100
time
<Double>
Read-write
Time per file (sec).
Default value: 3600
Minimum value = 1
size
<Double>
Read-write
Size of the captured data. Set 0 for full packet trace.
Default value: 164
Minimum value = 0
Maximum value = 1514
mode
<String[]>
Read-write
Capturing mode for trace. Mode can be any of the following values or combination of these values:
RX Received packets before NIC pipelining (Filter does not work when RX capturing mode is ON)
NEW_RX Received packets after NIC pipelining
TX Transmitted packets
TXB Packets buffered for transmission
IPV6 Translated IPv6 packets
C2C Capture C2C message
NS_FR_TX TX/TXB packets are not captured in flow receiver.
MPTCP MPTCP master flow
Default mode: NEW_RX TXB .
Default value: DEFAULT_MODE
Possible values = TX, TXB, RX, IPV6, NEW_RX, C2C, NS_FR_TX, APPFW, MPTCP
pernic
<String>
Read-write
Use separate trace files for each interface. Works only with tcpdump format.
Default value: DISABLED
Possible values = ENABLED, DISABLED
filename
<String>
Read-write
Name of the trace file.
fileid
<String>
Read-write
ID for the trace file name for uniqueness. Should be used only with -name option.
filter
<String>
Read-write
Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format:
<expression> [<relop> <expression>]

<relop> = ( && | || )

<expression> =:
CONNECTION.<qualifier>.<qualifier-method>.(<qualifier-value>)

<qualifier> = SRCIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.SRCIP.EQ(127.0.0.1)

<qualifier> = DSTIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.DSTIP.EQ(127.0.0.1)

<qualifier> = IP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.IP.EQ(127.0.0.1)

<qualifier> = SRCIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1)

<qualifier> = DSTIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1)

<qualifier> = IPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1)

<qualifier> = SRCPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.SRCPORT.EQ(80)

<qualifier> = DSTPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.DSTPORT.EQ(80)

<qualifier> = PORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.PORT.EQ(80)

<qualifier> = VLANID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid VLAN ID.
example = CONNECTION.VLANID.EQ(0)

<qualifier> = CONNID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid PCB dev number.
example = CONNECTION.CONNID.EQ(0)

<qualifier> = PPEID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid core ID.
example = CONNECTION.PPEID.EQ(0)

<qualifier> = SVCNAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = A valid text string.
example = CONNECTION.SVCNAME.EQ("name")

<qualifier> = LB_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = LB vserver name.
example = CONNECTION.LB_VSERVER.NAME.EQ("name")

<qualifier> = CS_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = CS vserver name.
example = CONNECTION.CS_VSERVER.NAME.EQ("name")

<qualifier> = INTF
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid interface id in the
form of x/y.
example = CONNECTION.INTF.EQ("x/y")

<qualifier> = SERVICE_TYPE
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = ( SVC_HTTP | FTP | TCP | UDP | SSL |
SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS |
RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY|
MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP |
SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN )
example = CONNECTION.SERVICE_TYPE.EQ(ANY)

<qualifier> = TRAFFIC_DOMAIN_ID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid traffic domain ID.
example = CONNECTION.TRAFFIC_DOMAIN_ID.EQ(0)

eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))"
The filter expression should be given in double quotes.

common use cases:

Trace capturing full sized traffic from/to ip 10.102.44.111, excluding loopback traffic
start nstrace -size 0 -filter "CONNECTION.IP.NE(127.0.0.1) && CONNECTION.IP.EQ(10.102.44.111)"

Trace capturing all traffic to (terminating at) port 80 or 443
start nstrace -size 0 -filter "CONNECTION.DSTPORT.EQ(443) || CONNECTION.DSTPORT.EQ(80)"

Trace capturing all backend traffic specific to service service1 along with corresponding client side traffic
start nstrace -size 0 -filter "CONNECTION.SVCNAME.EQ("service1")" -link ENABLED

Trace capturing all traffic through NS interface 1/1
start nstrace -filter "CONNECTION.INTF.EQ("1/1")"

Trace capturing all traffic specific through vlan 2
start nstrace -filter "CONNECTION.VLANID.EQ(2)"

Trace capturing all frontend (client side) traffic specific to lb vserver vserver1 along with corresponding server side traffic
start nstrace -size 0 -filter "CONNECTION.LB_VSERVER.NAME.EQ("vserver1")" -link ENABLED .
link
<String>
Read-write
Includes filtered connection's peer traffic.
Default value: DISABLED
Possible values = ENABLED, DISABLED
nodes
<Double[]>
Read-write
Nodes on which tracing is started.

Minimum value = 0
Maximum value = 32
filesize
<Double>
Read-write
File size, in MB, treshold for rollover.

Default value: 0
Minimum value = 0
Maximum value = 65536
traceformat
<String>
Read-write
Format in which trace will be generated
.
Default value: 0
Possible values = NSCAP, PCAP
merge
<String>
Read-write
Specify how traces across PE's are merged
.
Default value: 0
Possible values = ONSTOP, ONTHEFLY, NOMERGE
doruntimecleanup
<String>
Read-write
Enable or disable runtime temp file cleanup.
Default value: ENABLED
Possible values = ENABLED, DISABLED
tracebuffers
<Double>
Read-write
Number of 16KB trace buffers.
Default value: 5000
Minimum value = 1000
skiprpc
<String>
Read-write
skip RPC packets.
Default value: DISABLED
Possible values = ENABLED, DISABLED
skiplocalssh
<String>
Read-write
skip local SSH packets.
Default value: DISABLED
Possible values = ENABLED, DISABLED
capsslkeys
<String>
Read-write
Capture SSL Master keys. Master keys will not be captured on FIPS machine.
Warning: The captured keys can be used to decrypt information that may be confidential. The captured key files have to be stored in a secure environment.
Default value: DISABLED
Possible values = ENABLED, DISABLED
inmemorytrace
<String>
Read-write
Logs packets in appliance's memory and dumps the trace file on stopping the nstrace operation.
Default value: DISABLED
Possible values = ENABLED, DISABLED
state
<String>
Read-only
Current running state of trace.
Default value: 0
Possible values = RUNNING, STOPPED
scope
<String>
Read-only
Scope of started trace, local or cluster level.
Default value: 0
Possible values = CLUSTER, LOCAL
tracelocation
<String>
Read-only
Directory where current trace files are saved.

Operations (click to see Properties)

Some options that you can use for each operations:

  • Getting warnings in response: NITRO allows you to get warnings in an operation by specifying the "warning" query parameter as "yes". For example, to get warnings while connecting to the NetScaler appliance, the URL is as follows:

    http://<netscaler-ip-address>/nitro/v1/config/login?warning=yes

    If any, the warnings are displayed in the response payload with the HTTP code "209 X-NITRO-WARNING".

  • Authenticated access for individual NITRO operations: NITRO allows you to logon to the NetScaler appliance to perform individual operations. You can use this option instead of creating a NITRO session (using the login object) and then using that session to perform all operations,

    To do this, you must specify the username and password in the request header of the NITRO request as follows:

    X-NITRO-USER:<username>

    X-NITRO-PASS:<password>

    Note: In such cases, make sure that the request header DOES not include the following:

    Cookie:NITRO_AUTH_TOKEN=<tokenvalue>

메모

Mandatory parameters are marked in red and placeholder content is marked in <green>.

get (all)

URL: http://<netscaler-ip-address>/nitro/v1/config/nstrace

HTTP Method: GET

Request Headers:

Cookie:NITRO_AUTH_TOKEN=<tokenvalue>
Accept:application/json

Response:

HTTP Status Code on Success: 200 OK
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error

Response Headers:

Content-Type:application/json

Response Payload:

{ "nstrace": [ {
      "state":<String_value>,
      "scope":<String_value>,
      "tracelocation":<String_value>,
      "nf":<Double_value>,
      "time":<Double_value>,
      "size":<Double_value>,
      "mode":<String[]_value>,
      "traceformat":<String_value>,
      "pernic":<String_value>,
      "filename":<String_value>,
      "fileid":<String_value>,
      "filter":<String_value>,
      "link":<String_value>,
      "nodes":<Double[]_value>,
      "merge":<String_value>,
      "doruntimecleanup":<String_value>,
      "tracebuffers":<Double_value>,
      "skiprpc":<String_value>,
      "skiplocalssh":<String_value>,
      "capsslkeys":<String_value>,
      "inmemorytrace":<String_value>
}]}