How do you collect full body log WAF on Citrix ADC

[Hoang Hung]

Hi team

Do you know " how do you collect full body log WAF on Citrix ADC"

I tried on Audit Message Action. But I don't know writen Expression collect full Body log?

 

Please help

Thanks

Hung Hoang

[CarlStalhood]

NetScaler Web Server Logging can log every request, but I don't think it can do the body. You might have to do a network trace to capture the body. https://docs.netscaler.com/en-us/citrix-adc/current-release/system/web-server-logging.html

[Rhonda Rowland1709152125]

Agree with Carl. NSWL will give you web transaction logs but will NOT capture the full body.

 

I would be very cautious doing this through audit logging policies or logging actions on responder/rewrite, but it MIGHT work.

Is this a full request or a full response logging?

And is this something you just need some of or for all transactions for all time?  Or is this being done for a targeted type of review until you can turn it off?

And are you trying to capture the request the user sends, or the changes the netscaler makes (or the response side from server)?

 

For targeted troubleshooting I would start with the nstrace with AppFw logging enabled.  Enable nstrace support in the appfw profile; enable nstrace with the appfw logging option in the nstrace instance. And then you should see the appfw events along side your packet trace.

This won't solve the problem if you need to log every request for every response for all transactions problem.