This article describes how to log TCP connection information on NetScaler.

Background

NetScaler by default does not log TCP (Layer-4) information. For Example, in a SSL_Bridge scenario we do not perform any logging because there is no action being performed by NetScaler at layer 7.

Instructions

1. Add a Syslog Action with "-tcp ALL"
   add audit syslogAction syslog_act 10.107.189.114 -logLevel EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL -tcp ALL

2. Add a Syslog Policy and bind to the syslog action
   add audit syslogPolicy test_pol ns_true syslog_act

3. Binding
   Option-1: Bind the syslog policy to the required vserver, TCP connection logging for specific Vserver Only
   bind lb vserver Test_Lb_Vip -policyName test_pol -priority 100
    
   Option-2: Bind the syslog policy Globally.
   bind system global test_pol