audserver on Windows

[Carsten Peukert]

After Upgrade a Netscaler VPX from Version  11.1-65.10 to 12.1-58.14 the audserver.exe in Windows repeatly crashs.

I use this Version:

Netscaler Auditing Server (audserver) NS12.1: Build 57.18, Date: Jun  9 2020, 12:02:41 (release) [Windows NT/2000].

 

I does not change any configuration on the Netscaler and the auditlog.conf.

Also the content of the log File is not correct (e.g. truncated usernames).

 

What can I do?

 

 

 

 

[Rhonda Rowland1709152125]

The audit server usually needs to match the version for the firmware you are using. Especially since your firmware is newer than the auditserver in use.  

Try upgrading the auditserver from the ADC downloads where you get the adc firmware to the 12.1.58.14 or newer instead of 12.1.57.18

Or check the 12.1 release notes for any known issues.

 

It is possible that it is an issue with the 12.1.58.14 build, but I would check the audit server version too is a match first.

[Carsten Peukert]

All Software from the same release!

> sh version
        NetScaler NS12.1: Build 58.14.nc, Date: Aug 14 2020, 06:46:26   (64-bit)

 

c:\Logging>audserver.exe -version
Version: Netscaler Auditing Server (audserver) NS12.1: Build 58.14, Date: Aug 14 2020, 07:50:03 (release) [Windows NT/2000]

 

This are my audit settings.

> sh run | grep -i audit
add audit nslogAction AUDIT-LONG 172.31.10.116 -logLevel EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL -timeZone LOCAL_TIME
add audit nslogPolicy AUDIT ns_true AUDIT-LONG
bind audit syslogGlobal -policyName SETSYSLOGPARAMS_ADV_POL -priority 2000000000
bind audit nslogGlobal -policyName SETNSLOGPARAMS_ADV_POL -priority 2000000000
bind system global AUDIT -priority 100

 

I use nfactor authentication.

After login requests the audserver crashs with 0 Byte data in the audit logfile.

 

Before upgrade the netsclaer and the audserver the configuration works fine.

 

Problemsignatur:
  Problemereignisname:    APPCRASH
  Anwendungsname:    audserver.exe
  Anwendungsversion:    0.0.0.0
  Anwendungszeitstempel:    5f36a49e
  Fehlermodulname:    audserver.exe
  Fehlermodulversion:    0.0.0.0
  Fehlermodulzeitstempel:    5f36a49e
  Ausnahmecode:    c0000005
  Ausnahmeoffset:    0001fe8d
  Betriebsystemversion:    6.1.7601.2.1.0.256.48
  Gebietsschema-ID:    1031
  Zusatzinformation 1:    1a44
  Zusatzinformation 2:    1a44d1cdb81567eb0aa81587910a5a25
  Zusatzinformation 3:    ab3d
  Zusatzinformation 4:    ab3d4411500ade2399787205a08c437c

 

I have tested on two different systems.

 

[Rhonda Rowland1709152125]

It might be a bug with the update then.  You should contact to support to find out if known issue or if there is a workaround.

Someone from support might see it here; but no guarantee.

 

[Carsten Peukert]

This should be a bug. :-(

The actual version for Windows (13.0-61.48) have the same problem - crashing!!!

 

Before upgrade the installation works great.

 

The nslog server for Linux works fine in my lab, but the customer have no linux machine on the right place.

 

Thanks for the answer.