Configuring Citrix ADC appliance for audit logging
Warning:
Classic policy expressions and its usage are deprecated (discouraged from use but still supported) from Citrix ADC 12.0 build 56.20 onwards and as an alternative, Citrix recommends you to use advanced policies. For more information, seeAdvanced Policies.
Audit logging displays status information from different modules so that an administrator can see event history in the chronological order. Main components of an Audit framework are ‘audit action’, ‘audit policy’. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. The audit policies use ‘Classic Policy Engine’(CPE) framework or Progress Integration (PI) framework to link ‘audit action’ to ‘system global bind entities’.
However, the policy frameworks differ from each other in binding audit log policies to global entities. Previously, the audit module supported only classic expression but now it supports both classic and advanced policy expressions. Currently, using the advanced expression you can bind audit log policies only to System global entities.
Note
When you bind a policy to global entities, you must bind it to a system global entity of the same expression. For example, you cannot bind a classic policy to an advanced global entity or bind an advanced policy to a classic global entity.
Also, you cannot bind both classic audit log policy and advanced audit log policy to a load balancing virtual server.
Configuring audit log policies in a classic policy expression
Configuring audit logging in classic policy consists of the following steps:
- Configuring an audit log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, the SYSLOG, and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the Citrix ADC appliance to store the logs. After which the logs are sent to the SYSLOG server.
- Configuring audit log policy. You can either configure SYSLOG policies to log messages to a SYSLOG server or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule identifying the messages to be logged, and a SYSLOG or NS LOG action.
- Binding audit log policies to global entities. You must globally bind the audit log policies to global entities such SYSTEM, VPN, Citrix ADC AAA and so on. You can do it to enable logging of all Citrix ADC system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.
Each of these steps is explained in the following sections.
Configuring audit log action
To configure SYSLOG action in advanced policy infrastructure by using the CLI.
Note
The Citrix ADC appliance allows you to configure only one SYSLOG action to SYSLOG server IP address and port. The appliance does not allow you to configure multiple SYSLOG actions to the same server IP address and port.
A syslog action contains a reference to a syslog server. It specifies which information to log and mentions how to log that information.
At the command prompt, type the following commands to set the parameters and verify the configuration:
- add audit syslogAction [-serverPort ] -logLevel [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )]` - show audit syslogAction [] Configure the NSLOG action in advanced policy infrastructure by using the CLI.
A ns log action contains a reference to a nslog server. It specifies which information to log and mentions how to log that information.
At the command prompt, type the following commands to set the parameters and verify the configuration:
- add audit nslogAction [-serverPort ] -logLevel [-dateFormat ( MMDDYYYY | DDMMYYYY )] - show audit nslogAction [] Configuring audit log policies
配置一个udit log Policies in classic policy infrastructure by using the CLI.
在命令提示符下,键入:
- add audit syslogpolicy <-rule> - add audit nslogpolicy <-rule> Binding audit syslog policies to audit syslog global
Bind audit log policy in advanced policy framework by using the CLI.
在命令提示符下,键入:
bind audit syslogGlobal
unbind audit syslogGlobal
Bind audit log policy in classic policy framework by using the CLI.
在命令提示符下,键入:
bind systemglobal
unbind systemglobal
Configuring audit log policies using advanced policy expression
Configuring audit logging in advanced policy consists of the following steps:
- Configuring an audit log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, the SYSLOG, and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the Citrix ADC appliance to store the logs. After which the logs are sent to the SYSLOG server.
- Configuring audit log policy. You can either configure SYSLOG policies to log messages to a SYSLOG server or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule identifying the messages to be logged, and a SYSLOG or NS LOG action.
- Binding audit log policies to global entities. You must globally bind the audit log policies to SYSTEM global entity to enable logging of all Citrix ADC system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.
Note
The Citrix ADC appliance evaluates all the policies that are bind to true.
Configuring audit log action
Configure syslog action in advanced policy infrastructure by using the CLI.
At the command prompt, type the following commands to set the parameters and verify the configuration:
- add audit syslogAction [-serverPort ] -logLevel [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )] - show audit syslogAction [] Configure NSLOG action in advanced policy infrastructure by using the CLI.
At the command prompt, type the following commands to set the parameters and verify the configuration:
- add audit nslogAction [-serverPort ] -logLevel [-dateFormat ( MMDDYYYY | DDMMYYYY )] - show audit nslogAction [] Configuring audit log policies
Add a syslog audit action by using the CLI.
在命令提示符下,键入:
add audit syslogAction ( | (([-domainResolveRetry ]) | -lbVserverName ))[-serverPort ] -logLevel [-dateFormat ] [-logFacility ][-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] [-subscriberLog ( ENABLED | DISABLED )][-transport ( TCP | UDP )] [-tcpProfileName ][-maxLogDataSizeToHold Example
> add audit syslogaction audit-action1 10.102.1.1 -loglevel INFORMATIONAL -dateformat MMDDYYYY > add audit nslogAction nslog-action1 10.102.1.3 -serverport 520 -loglevel INFORMATIONAL -dateFormat MMDDYYYY > add audit syslogpolicy syslog-pol1 TRUE audit-action1 > add audit nslogPolicy nslog-pol1 TRUE nslog-action1 > bind system global nslog-pol1 -priority 20 Add a nslog audit action by using the CLI.
在命令提示符下,键入:
add audit nslogAction ( | ([-domainResolveRetry ])) [-serverPort ] -logLevel ... [-dateFormat ][-logFacility ] [-tcp ( NONE | ALL )][-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )][-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] [-subscriberLog ( ENABLED | DISABLED )]` Binding audit log policies to global entities
Bind syslog audit log policy in advanced policy framework by using the CLI.
在命令提示符下,键入:
bind audit syslogGlobal
unbind audit syslogGlobal
Configuring audit log policy by using the GUI
- Navigate toConfiguration>System>Auditing>Syslog.
- SelectServerstab.
- ClickAdd.
- In theCreate Auditing Serverpage, populate the relevant fields, and clickCreate.
- To add the policy, select thePoliciestab, and clickAdd.
In theCreate Auditing Syslog Policypage, populate the relevant fields, and clickCreate.
- To bind the policy globally, selectAdvanced Policy Global Bindingsfrom the drop-down list. Select thebest_syslog_policy_everpolicy. ClickSelect.
- From the drop-down list, select the bind point asSYSTEM_GLOBALand clickBind, and then clickDone.
Configuring policy-based logging
You can configure policy-based logging for rewrite and responder policies. Audit messages are then logged in a defined format when the rule in a policy evaluates to TRUE. To configure policy-based logging, you configure an audit-message action that uses default syntax expressions to specify the format of the audit messages. And associate the action with a policy. The policy can be bound either globally or to a load balancing or content switching virtual server. You can use audit-message actions to log messages at various log levels, either in syslog format only or in both syslog and new nslog formats
Prerequisites
- User Configurable Log Messages (userDefinedAuditlog) option is enabled for when configuring the audit action server to which you want to send the logs in a defined format.
- The related audit policy is bound to system global.
Configuring an audit message action
You can configure audit message actions to log messages at various log levels, either in syslog format only or in both syslog and new ns log formats. Audit-message actions use expressions to specify the format of the audit messages.
Create an audit message action by using the CLI
在命令提示符下,键入:
add audit messageaction [-logtoNewnslog (YES|NO)] [-bypassSafetyCheck (YES|NO)] add audit messageaction log-act1 CRITICAL '"Client:"+CLIENT.IP.SRC+" accessed "+HTTP.REQ.URL' -bypassSafetyCheck YES 配置一个n audit message action by using the GUI
Navigate toSystem > Auditing > Message Actions, and create the audit message action.
Binding audit message action to a policy
After you have created an audit message action, you must bind it to a rewrite or responder policy. For more information about binding log message actions to a rewrite or responder policy, seeRewriteorResponder.