Under normal operating conditions, the NetScaler Packet Processing Engine (NSPPE) frequently writes system events to ns.log (most are INFO level). These logs include command executions, entity status changes and so on. In a healthy state, the log contains entries specifically tagged from the PPE (e.g., 0-PPE-1), as shown in this sample:

Mar 12 12:01:27 <local0.info> x.x.x.x  03/12/2026:12:01:27 GMT  0-PPE-1 : default API CMD_EXECUTED 424418 0 :  User XXX - ADM_User NONE - Remote_ip x.x.x.x - Command "show HA node" - Status "Success"
Mar 12 12:01:27 <local0.info> x.x.x.x  03/12/2026:12:01:27 GMT  0-PPE-1 : default API CMD_EXECUTED 424419 0 :  User XXX - ADM_User NONE - Remote_ip x.x.x.x - Command "show route" - Status "Success"

Sometimes, the NSPPE may stop writing to ns.log. While other system processes (such as nsconfigd or nsnetsvc) continue to log their activities, the expected PPE entries are missing. Notice that the entries below are limited to management processes, with no PPE activity recorded.

Feb  6 09:40:58 <local0.info> x.x.x.x nsconfigd[1099]: cfd_clients_renumber(): client renumbered, sessid 16777213 new value 3
Feb  6 09:40:58 <local0.info> x.x.x.x nsconfigd[1099]: cfd_clients_renumber(): client renumbered, sessid 16777214 new value 4
Feb  7 00:24:05 <local0.info> x.x.x.x nsnetsvc[44405]: nscfe_shrun_post(): Show run started
Feb  7 00:24:06 <local0.info> x.x.x.x nsnetsvc[44405]: nscfe_shrun_post(): Showrun Complete

Typically, the absence of NSPPE logs can be traced back to one of two administrative configuration errors.

1. The NetScaler syslog parameter Loglevel may have been inadvertently set to NONE.

> show audit syslogParams
        Server IP: 127.0.0.1    Port: 514
        Loglevel : NONE         # <--- Problematic configuration

2. (For version 14.1) The default advanced syslog policy, SETSYSLOGPARAMS_ADV_POL, may have been unbound from the global system level. This policy is responsible for ensuring the PPE correctly directs logs to the local syslog daemon.

> show audit syslogGlobal
...
X)      Policy Name: SETSYSLOGPARAMS_ADV_POL    
        Priority: 65534
        GlobalType: SYSTEM_GLOBAL

Note: If SETSYSLOGPARAMS_ADV_POL is missing from the output above, the NSPPE will fail to write to the local ns.log.

Scenario 1: Restoring the Default Log Level

If Loglevel was set to NONE, you must restore the standard logging levels to resume PPE logging.

> set audit syslogParams -loglevel CRITICAL EMERGENCY ERROR ALERT WARNING NOTICE INFORMATIONAL
 Done

Scenario 2: (For version 14.1) Re-binding the Global Syslog Policy

If the SETSYSLOGPARAMS_ADV_POL policy was missing from the global audit bindings, please rebind it.

> bind audit syslogGlobal -policyName SETSYSLOGPARAMS_ADV_POL -priority 65534
 Done

This article describes a typical logging issue on NetScaler.