Jump to content
Welcome to our new Citrix community!

Is there a report that shows client source IP to service


Recommended Posts

NetScaler Web Logging (nswl) (aka Citrix Web Logging) will show you web transaction logs which can be used to identify which source IP is sent to which server ip.

This is the one piece of info citrix doesn't log internally, but you can deploy the NSWL.exe utility (downloadable from where you download the firmware) and confirm the external log format as ncsa or w3c or w3c extended (custom fields) and then review the transaction logs.

See admin guide for details: https://docs.citrix.com/en-us/netscaler/12/system/web-server-logging/installing-netscaler-web-logging-client.html (This is 12.x but same settings for 13.x)

 

Other ways to do this, is to use the ADC to insert a client ip header and have your backend web servers generate the web transaction logs.

 

 

 

  • Like 1
Link to comment
Share on other sites

So I got the nswl installed. But after executing the commands below I went to one 

of the VIPs which worked. But I was expecting to see some signs of my activity

in the log file. But you can see below the log file didn't reveal any sign that

I'd been there. Perhaps I'm missing a final step? I haled the logging with

^C a minute or so after visiting the VIP/Service. Any thought?

 

C:\Temp\bin>nswl -install -f "c:\Program Files (x86)"\NSWL\log.conf
Netscaler Weblogging Service installed.
Done !!

 

C:\Temp\bin>nswl -addns -f "c:\Program Files (x86)"\NSWL\log.conf
NSIP:10.1.1.78
userid:admin
password:Done !!

C:\Temp\bin>nswl -verify -f "c:\Program Files (x86)"\NSWL\log.conf
#Debug log file is ./nswl.log-080420201751 & Log level is 1
#NetScaler weblogging configuration file c:\Program Files (x86)\NSWL\log.conf is correct
Done !!

 

C:\Temp\bin>nswl -start -f "c:\Program Files (x86)"\NSWL\log.conf
#Debug log file is ./nswl.log-080420201751 & Log level is 1
#NetScaler weblogging configuration file c:\Program Files (x86)\NSWL\log.conf is correct

 

@(#)Netscaler Weblogging Application(nswl) NS12.1: Build 56.22, Date: Mar 29 2020, 02:05:02 (release) [Windows NT/2000]
NSIP : :10.1.11.77 username admin password ##### 
@(#)Netscaler Weblogging Application(nswl) NS12.1: Build 56.22, Date: Mar 29 2020, 02:05:02 (release) [Windows NT/2000]
NSIP : :10.1.11.77 username admin password ##### 
RPC Signature is valid
Login successful (nspe=10.1.11.77:user=admin:socket=340)
RPC Signature is valid
RPC Signature is valid
Logmsg successful (nspe=10.1.11.77:user=admin:socketid=340)
NSWL:quiting on 2 signal!

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...