You may notice that NetScaler stops generating syslog in ns.log after we change the syslog server IP from 127.0.0.1 to some other IP under global syslog parameter.

We can verify the current server IP under syslog paramertes with the following command.

> show audit syslogParams
        Server IP: 127.0.0.1    Port: 514
        Loglevel : EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL
        Date Format: MMDDYYYY

When the syslog server IP is set to 127.0.0.1, the NetScaler sends syslog messages to itself and stores them in ns.log.

If the syslog server IP is changed from 127.0.0.1 to another IP, NetScaler will stop writing logs to ns.log and will instead send the syslog messages to the specified remote IP address.

We can use the following command to restore the syslog parameters to their default values. This will cause the NetScaler to generate logs in ns.log.

set audit syslogParams -serverIP 127.0.0.1 -logLevel EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL
save config

This article describes an issue where the NetScaler stops generating syslog messages in ns.log after the syslog server IP is changed in the global syslog parameters.