Which logging features are supported within an admin-partitioned ADC?

[Christoph Wagner1709155701]

Hi,

which logging features are supported within a partitioned Citrix ADC.

(at the moment we use Netscaler 12.0, but if necessary we can also upgrade to a new ADC software)

 

We would like to implement full header logging (request / response headers) - send to Splunk, etc.

ADM, splunk, Cisco Tetration should also be connected and we would like to attach the features APPFLOW, IPFIX, Audit Logging, Web Logging.

 

I do not really find a good documentation which features are available and how to handle/configure these features for admin-partitioned ADC.

 

Hopefully Admin-Partitions are supported, because otherwise the admin-partitioning is still not really useable in production environments.

 

Kind Regards

Chris

 

[Diego Oliveira]

Hi

Did you check this link? 

https://docs.citrix.com/en-us/netscaler/12/admin-partition/admin-partition-config-types.html

[Rhonda Rowland1709152125]

Diego's article is the feature supported in admin partitions list; this is the 13.0 version:  https://docs.citrix.com/en-us/citrix-adc/13/admin-partition/admin-partition-config-types.html

 

Each admin partition has its own syslog:  /var/partitions/<partition name>/log/ns.log I think

 

nslog is system wide/default partition only and is not tracked per admin partitions. I believe the nslog though contains stats for all admin partition objects; but the nslog is not separate per partition.  They list audit logging as supported, but it seems to refer to syslog only for external logging.

 

NSWL aka Web Logging is listed as supported in an admin partition (But the NSWL is going to connect to the NSIP); my guess is web logging feature would have to be enabled in the admin partition (if not on) by default...but you'd have to play with the output to see.

 

AppFlow/IPFIX/LogStream is not supported in admin partitions; just default partition only, so unable to be enabled on vservers within admin partition is my understanding.