Ns.log File in /var/log Directory Does Not Log the SOURCE IP Address of Any Client Request Going Through the NetScaler Appliance

Ns.log File in /var/log Directory Does Not Log the SOURCE IP Address of Any Client Request Going Through the NetScaler Appliance

book

Article ID: CTX134939

calendar_today

Updated On:

Description

The ns.log file in the /var/log directory is not logging the SOURCE IP address of any client request going through a NetScaler appliance.

Resolution

Enable the TCP logging option for the NetScaler appliance to log the SOURCE IP address of any client request on the ns.log file in the /var/log directory:

Run the following command to verify if the Source IP address is logged in the ns.log file:

root@ns# tail -f ns.log
Aug 27 20:00:47 <local0.info> 10.217.245.231 08/27/2012:20:00:47 GMT  0-PPE-0 : TCP CONN_DELINK 4389 0 :  Source 10.210.224.177:59839 - Vserver 10.217.245.233:80 - NatIP 10.217.245.232:17708 - Destination 192.168.10.1:80 - Delink Time 08/27/2012:20:00:47 GMT - Total_bytes_send 464 - Total_bytes_recv 64248
Aug 27 20:00:48 <local0.info> 10.217.245.231 08/27/2012:20:00:48 GMT  0-PPE-0 : TCP CONN_DELINK 4391 0 :  Source 10.210.224.177:59839 - Vserver 10.217.245.233:80 - NatIP 10.217.245.232:17708 - Destination 192.168.10.1:80 - Delink Time 08/27/2012:20:00:48 GMT - Total_bytes_send 470 - Total_bytes_recv 240
Aug 27 20:00:48 <local0.info> 10.217.245.231 08/27/2012:20:00:48 GMT  0-PPE-0 : TCP CONN_TERMINATE 4392 0 :  Source 10.210.224.177:59839 - Destination 10.217.245.233:80 - Start Time 08/27/2012:20:00:47 GMT - End Time 08/27/2012:20:00:48 GMT - Total_bytes_send 1 - Total_bytes_recv 1
Aug 27 20:01:00 <local0.info> 10.217.245.231 08/27/2012:20:01:00 GMT  0-PPE-0 : TCP CONN_TERMINATE 4410 0 :  Source 10.210.224.177:59841 - Destination 10.217.245.233:80 - Start Time 08/27/2012:20:01:00 GMT - End Time 08/27/2012:20:01:00 GMT - Total_bytes_send 1 - Total_bytes_recv 1
Aug 27 20:01:00 <local0.info> 10.217.245.231 08/27/2012:20:01:00 GMT  0-PPE-0 : TCP CONN_TERMINATE 4411 0 :  Source 10.210.224.177:59840 - Destination 10.217.245.233:80 - Start Time 08/27/2012:20:01:00 GMT - End Time 08/27/2012:20:01:00 GMT - Total_bytes_send 1 - Total_bytes_recv 1

Problem Cause

By default the global auditing settings for the TCP Logging option is disabled. To log TCP information like Source IP address, the TCP logging option must be enabled.

User-added image

Issue/Introduction

The ns.log file in the /var/log directory is not logging the SOURCE IP address of any client request going through a NetScaler appliance.
Powered by Wolken Software