This article dsecribe how to check load balanced vserver or service down events in log files.

---

Instructions

You can find load balanced vserver/service down events in ns.log/newnslo. In this example, the name of load balanced vserver is "10.158.248.101_WEB", the name of service is "10.158.247.4".

1. ns.log

Using command "cat ns.log |grep "10.158.247.4\|10.158.248.101" |grep -v "show"" to find the according events.
 
Feb 16 11:49:21 <local0.info> 10.158.232.6 02/16/2022:03:49:21 GMT NS1 0-PPE-0 : default EVENT MONITORDOWN 7867946 0 :  Monitor MonServiceBinding_10.158.247.4:80_(down_monitor)(10.158.247.4) - State DOWN
Feb 16 11:49:21 <local0.notice> 10.158.232.6 02/16/2022:03:49:21 GMT NS1 0-PPE-0 : default EVENT DEVICEDOWN 7867947 0 :  Device "server_svc_cfg_NSSVC_HTTP_10.158.247.4:80(10.158.247.4)" - State DOWN
Feb 16 11:49:21 <local0.notice> 10.158.232.6 02/16/2022:03:49:21 GMT NS1 0-PPE-0 : default EVENT DEVICEDOWN 7867948 0 :  Device "server_vip_NSSVC_HTTP_10.158.248.101:80(10.158.248.101_WEB)" - State DOWN

2. newnslog

• Use command "nsconmsg -K newnslog -d setime" to verify if this log file including the time frame when the issue occurred.

Displaying start and end time information
NetScaler V20 Performance Data
NetScaler NS12.1: Build 57.18.nc, Date: Jun  9 2020, 11:36:40   (64-bit)
 
start time Wed Feb 16 03:51:39 2022
end   time Wed Feb 16 11:56:00 2022
total duration     00.08:04:21
data size 65,748,992 bytes

• Then use command "nsconmsg -K newnslog -d event |grep "10.158.247.4\|10.158.248.101"" to find the according events, you can also find out why monitor probe failed.

8034   243 PPE-0 MonServiceBinding_10.158.247.4:80_(down_monitor)(10.158.247.4): DOWN; Last response: Failure - Time out during TCP connection establishment stage Wed Feb 16 11:38:33 2022
8035     0 PPE-0 'server_svc_cfg_NSSVC_HTTP_10.158.247.4:80(10.158.247.4)' DOWN Wed Feb 16 11:38:33 2022
8080     7 PPE-0 MonServiceBinding_10.158.247.4:80_(tcp-default)(10.158.247.4): UP; Last response: Success - TCP syn+ack received. Wed Feb 16 11:41:32 2022
8081     0 PPE-0 'server_svc_cfg_NSSVC_HTTP_10.158.247.4:80(10.158.247.4)' UP Wed Feb 16 11:41:32 2022
8082     0 PPE-0 'server_vip_NSSVC_HTTP_10.158.248.101:80(10.158.248.101_WEB)' UP Wed Feb 16 11:41:32 2022
8093    99 PPE-0 MonServiceBinding_10.158.247.4:80_(down_monitor)(10.158.247.4): DOWN; Last response: Failure - Probe failed. Wed Feb 16 11:49:21 2022
8094     0 PPE-0 'server_svc_cfg_NSSVC_HTTP_10.158.247.4:80(10.158.247.4)' DOWN Wed Feb 16 11:49:21 2022
8095     0 PPE-0 'server_vip_NSSVC_HTTP_10.158.248.101:80(10.158.248.101_WEB)' DOWN Wed Feb 16 11:49:21 2022