nswl 收集日志
参考链接：https://docs.citrix.com/en-us/citrix-adc/12-1/system/web-server-logging.html
PS C:UsersLSGXDesktopxxxin> .
swl.exe -help
usage : nswl -[cmds] [cmd arguments]
cmds cmd arguments: -f <filename> -d debug
-help - detail help
-start - cmd arguments [starts weblogging]
-verify - cmd arguments [verifies config file]
-addns - cmd arguments [add a netscaler to conf file]
-install - cmd arguments [install program as a service ]
-remove - cmd arguments [remove service]
-startservice - start Netscaler Weblogging service
-stopservice - stop Netscaler Weblogging service
-version - prints the version info
PS C:UsersLSGXDesktopxxxin>
PS C:UsersLSGXDesktopxxxin> .
swl.exe -addns -f .log.conf
NSIP:192.168.195.91
userid:nsroot
password:Done !!
PS C:UsersLSGXDesktopxxxin>
PS C:UsersLSGXDesktopxxxin> .
swl.exe -start -f .log.conf
log.conf 文件内容
##########
# This is the NSWL configuration file
# Only the default filter is active
# Remove leading # to activate other filters
##########
##########
# Default filter (default on)
# W3C Format logging, new file is created every hour or on reaching 10MB file size,
# and the file name is Exyymmdd.log
##########
Filter default
begin default
logFormat W3C
logInterval Hourly
logFileSizeLimit 10
logFilenameFormat Ex%{%y%m%d}t.log
end default
##########
# Netscaler caches example
# CACHE_F filter covers all the transaction with HOST name www.netscaler.com and the listed server ip's
##########
#Filter CACHE_F HOST www.netscaler.com IP 192.168.100.89 192.168.100.95 192.168.100.52 192.168.100.53 ON
##########
# Netscaler origin server example
# Not interested in Origin server to Cache traffic transaction logging
##########
#Filter ORIGIN_SERVERS IP 192.168.100.64 192.168.100.65 192.168.100.66 192.168.100.67 192.168.100.225 192.168.100.226 192.168.100.227 192.168.100.228 OFF
##########
# Netscaler image server example
# all the image server logging.
##########
#Filter IMAGE_SERVER HOST www.netscaler.images.com IP 192.168.100.71 192.168.100.72 192.168.100.169 192.168.100.170 192.168.100.171 ON
##########
# NCSA Format logging, new file is created every day midnight or on reaching 20MB file size,
# and the file name is /datadisk5/NETSCALER/log/NS<hostname>/Nsmmddyy.log.
# Exclude objects that ends with .gif .jpg .jar.
##########
#begin ORIGIN_SERVERS
# logFormat NCSA
# logInterval Daily
# logFileSizeLimit 40
# logFilenameFormat /datadisk5/ORGIN/log/%v/NS%{%m%d%y}t.log
# logExclude .gif .jpg .jar
#end ORIGIN_SERVERS
##########
# NCSA Format logging, new file is created every day midnight or on reaching 20MB file size,
# and the file name is /datadisk5/NETSCALER/log/NS<hostname>/Nsmmddyy.log with log record timestamp as GMT.
##########
#begin CACHE_F
# logFormat NCSA
# logInterval Daily
# logFileSizeLimit 20
# logFilenameFormat /datadisk5/NETSCALER/log/%v/NS%{%m%d%y}t.log
# logtime GMT
#end CACHE_F
##########
# W3C Format logging, new file on reaching 20MB and the log file path name is
# atadisk6/NETSCALER/log/server's ip/Exmmyydd.log with log record timestamp as LOCAL.
##########
#begin IMAGE_SERVER
# logFormat W3C
# logInterval Size
# logFileSizeLimit 20
# logFilenameFormat /datadisk6/NETSCALER/log/%AEx%{%m%d%y}t
# logtime LOCAL
#end IMAGE_SERVER
##########
# Virtual Host by Name firm, can filter out the logging based on the host name by,
##########
#Filter VHOST_F IP 10.101.2.151 NETMASK 255.255.255.0
#begin VHOST_F
# logFormat W3C
# logInterval Daily
# logFileSizeLimit 10
# logFilenameFormat /ns/prod/vhost/%v/Ex%{%m%d%y}t
#end VHOST_F
########## END FILTER CONFIGURATION ##########
NSIP 172.16.201.185 username nsroot password 230:1>0:1754434651,>*4*71>+3,33=/>3=-1+2-:(5(2-5,9*952.>6=1>,<77,4+9/>457<531118*;*321+>)83360170<616<6>.=2?74+3731;.?5610(=)4)550)46=.8/1*?.9-2*;4:2>/77:*>191<71/323*7-=2058);.2,>6?297:/1.849-1001>-5.9)5+>2?-17=)34<4=54-7+1.:400?(027655:.46<-72>6=+446.343
启动 nswl 客户端程序：
注意：收集的内容会写入 Ex*.log 文件中。
查看收集的日志内容：
How To Customize NetScaler Web Logging
https://support.citrix.com/article/CTX227457
Created: 06 Sep 2017 | Modified: 27 Sep 2017
Objective
This article describes how to configure NetScaler Web Logging (NSWL) client and customize NSWL logging.
Instructions
Enabling web logging feature on the NetScaler
- We can enable web logging feature using the command “enable ns feature WL” on cli or on gui by check the Web Logging in Advanced features:
Downloading NSWL client
- Open the URL: https://www.citrix.com/downloads.html.
- Log in to the site using your credentials.
- Open the page for the required release number and build.
- In the page, under Weblog Clients, click Download. The package has the name format as follows: Weblog-<release number>-<build number>.zip. In my case, it is nswl_win-11.1-52.13.
Installing NSWL client on Windows server
- Extract the nswl_win-11.1-52.13.zip file from the package.
- Copy the extracted file to a Windows system on which you want to install the NSWL client.
- On the Windows system, unzip the file in a directory (referred as <NSWL-HOME>). The following directories are extracted: bin, etc, and samples.
-
At the command prompt, run the following command from the <NSWL-HOME>in directory:
nswl -install -f <directorypath>log.conf
Adding the NSIP
-
Run the command nswl –addns –f <directorypath>log.conf (Please note that the nswl client logging only work with the nsroot user. So, always add userid as nsroot)
-
Once the NSIP has been added, you will see the entry in the bottom of the log.conf file (etclog.conf)
-
Verify if the log.conf file is correct using the command nswl –verify –f <directorypath>log.conf
-
We can start the service using the command nswl –start –f <directorypath>log.con
- Once we start the service, the logs will get generated in the <NSWL-HOME>in directory
Customizing logging to get the client ip address on the nswl logs
- By default the log format is w3c format.
- The fields that we get in the w3c format are “date time c-ip cs-username sc-servicename s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status cs-bytes sc-bytes time-taken cs-version cs(User-Agent) cs(Cookie) cs(Referer)”
- We can customize the logs as per the
- To export the “X-Forwarded-For” field from the http header by the web logging feature, configure the Custom HTTP Request Header to “X-Forwarded-For” in the Global System Settings.
- Then customize the log format to “custom %{%Y-%m-%d%H:%M:%S}t %a %u %S %A %p %m %U %q %s %j %J %T %H "%{user-agent}i" "%{cookie}i" "%{referer}i" "%{X-Forwarded-For}i" %T %M %e1 %e2”
================== End