Product Documentation

Configuring the NetScaler Appliance for Audit Logging

Oct 19, 2016

Auditing module allows logging of all states and status information from different modules so that an administrator can see event history in the chronological order. Main components of Audit framework are ‘audit action’, ‘audit policy’. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. The audit policies use ‘Classic Policy Engine’(CPE) framework to link ‘audit action’ to ‘bind entities’ or Progress Integration (PI) framework to link ‘audit action’ to ‘system global bind entities’.

The policy frameworks differ from each other in the way the audit-log policies are bound to the global entities. Previously, the audit module supported only Classic expression but now it supports both Classic and Advanced policy expressions. Currently, the Advanced expression can bind audit-log policies only to System global entities.

Note:  When binding a policy to global entities, you must bind a policy it to a system global entity of the same expression type. For example, you cannot bind a classic policy to an advanced global entity or bind an advanced policy to a classic global entity.

Configuring Audit-log Policies in a Classic Policy Expression

Configuring audit-logging in Classic policy consists of the following steps:

  1. Configuring an audit-log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, the SYSLOG and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the NetScaler appliance to store the logs. After the after which the logs are sent to the SYSLOG server.
  2. Configuring audit-log policy. Configure SYSLOG policies to log messages to a SYSLOG server, and/or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule identifying the messages to be logged, and a SYSLOG or NS LOG action.
  3. Binding audit-log policies to global entities. You must globally bind the audit log policies to global entities such SYSTEM, VPN, AAA etc., to enable logging of all NetScaler system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.

Each of these steps are explained in the following sections.

Configuring audit-log action

To configure syslog action in Advanced Policy infrastructure by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add audit syslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )]
  • show audit syslogAction [<name>]

To configure NSLOG action in Advanced Policy infrastructure by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add audit nslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )]
  • show audit nslogAction [<name>]

Configuring audit-log Policies

To configure audit-log Policies in Classic Policy infrastructure by using the command line interface

At the command prompt, type:

  • add audit syslogpolicy <name> <-rule> <action>
  • add audit nslogpolicy <name> < rule> < action >rm audit nslogpolicy <name>show audit nslogpolicy [<name>]set audit nslogpolicy <name>  [-rule <expression >] [-action <name>]

Binding audit-log policies to global entities

To bind audit-log policy in Classic policy framework by using the command line interface

At the command prompt, type:

bind auditlog systemglobal <auditlog policy> -globalType SYSTEM -priority

Configuring Audit-log Policies using Advanced Policy Expression

Configuring audit-logging in Advanced policy consists of the following steps:

  1. Configuring an audit-log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, the SYSLOG and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the NetScaler appliance to store the logs. After the after which the logs are sent to the SYSLOG server.
  2. Configuring audit-log policy. Configure SYSLOG policies to log messages to a SYSLOG server, and/or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule identifying the messages to be logged, and a SYSLOG or NS LOG action.
  3. Binding audit-log policies to global entities. You must globally bind the audit log policies to SYSTEM global entity to enable logging of all NetScaler system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.

Configuring audit-log action

To configure syslog action in Advanced Policy infrastructure by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add audit syslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )]
  • show audit syslogAction [<name>]

To configure NSLOG action in Advanced Policy infrastructure by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add audit nslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )]
  • show audit nslogAction [<name>]

Configuring audit-log Policies

To add a syslog audit action by using the command line interface

At the command prompt, type:

Adding an Syslog Audit action 복사

add audit syslogAction <name> (<serverIP> | ((<serverDomainName>[-domainResolveRetry <integer>]) 

| -lbVserverName <string>))[-serverPort <port>] -logLevel <logLevel>[-dateFormat <dateFormat>]

 [-logFacility <logFacility>][-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )]

[-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )]

 [-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] 

[-subscriberLog ( ENABLED | DISABLED )][-transport ( TCP | UDP )] [-tcpProfileName <string>][-maxLogDataSizeToHold 

To add a nslog audit action by using the command line interface

At the command prompt, type:

Adding Nslog Audit action 복사

add audit nslogAction <name> (<serverIP> | (<serverDomainName>[-domainResolveRetry <integer>])) [-serverPort <port>]       -logLevel <logLevel> ... [-dateFormat <dateFormat>][-logFacility <logFacility>] [-tcp ( NONE | ALL )][-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )][-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] [-subscriberLog ( ENABLED | DISABLED )]

Binding audit-log policies to global entities

To bind syslog audit-log policy in Advanced policy framework by using the command line interface

At the command prompt, type:

Binding Syslog Audit-log policy 복사

bind auditlog syslogglobal <auditlog policy> -globalType SYSTEM -priority

bind auditlog nslogglobal <auditlog policy> -globalType SYSTEM –priority

Configuring audit-log policy by using the NetScaler GUI

  1. Navigate to Configuration > System > Auditing > Syslog and then to Policies tab page to bind a syslog policy (advanced or classic) to system global entity. Note: System global can be either in “Classic” or “Advanced” mode. In “Classic” mode, you can bind only a classic audit-log policy and when in “Advanced” mode, you can bind only an advanced audit-log policy.
  2. Select a policy and click Action to select a system global binding (Advanced or Classic) from the drop-down list.
  3. In the Auditing Syslog Classic Policy Global Binding page, select a syslog policy and click Add Binding to bind the policy to system global entities (in Classic or Advance mode).  
Sample Audit-log Configuration 복사

> add audit syslogaction audit-action1 10.102.1.1 -loglevel INFORMATIONAL -dateformat MMDDYYYY

> add audit nslogAction nslog-action1 10.102.1.3 -serverport 520 -loglevel INFORMATIONAL -dateFormat MMDDYYYY

> add audit syslogpolicy syslog-pol1 ns_true audit-action1

> add audit nslogPolicy nslog-pol1 ns_true nslog-action1

> bind system global nslog-pol1 -priority 20