Syslog events not recorded on syslog messages page of NetScaler MAS.

Complete the following steps to troubleshoot this issue:

1. Verify if logs are sent to NetScaler MAS using TCPDUMP on port 514.

2. Examine mps_event.log under /var/mps/log for the following logs:

   Friday, 31 Mar 17 13:04:35.578 +0530 [Debug] [Main] *********SyslogPacketHandler::packetprocessor: Syslog Packets enqueued so far: 2222000 *********
   Friday, 31 Mar 17 13:08:35.060 +0530 [Debug] [Main] *********SyslogDecoder::dataConsumer: Size of queue before insert: 5*********
   *********SyslogDecoder::dataConsumer: Syslogs inserted to DB: 2222038 *********

3. The SyslogPacketHandler is generated every time logs are incremented by 1000. After this log is generated another log SyslogDecoder is generated after approximately 4 minutes.

4. If it takes more than 4 minutes then chances are that syslog processor did not parse that data. Maybe logs are coming to the device which is not configured as managed device on NetScaler MAS.

5. If the syslog packets are received and this counter is not increasing then the NetScaler MAS is not able to parse this data.

6. Verify if there are any errors that are related to syslog.

Citrix Documentation - How to View Auditing Information of NetScaler MAS