nswl 收集日志

参考链接：https://docs.citrix.com/en-us/citrix-adc/12-1/system/web-server-logging.html

PS C:\Users\LSGX\Desktop\xxx\bin> .\nswl.exe -help

usage : nswl -[cmds] [cmd arguments]

        cmds  cmd arguments: -f <filename> -d debug

        -help          - detail help

        -start         - cmd arguments [starts weblogging]

        -verify        - cmd arguments [verifies config file]

        -addns         - cmd arguments [add a netscaler to conf file]

        -install       - cmd arguments [install program as a service ]

        -remove        - cmd arguments [remove service]

        -startservice  - start Netscaler Weblogging service

        -stopservice   - stop Netscaler Weblogging service

        -version       - prints the version info

PS C:\Users\LSGX\Desktop\xxx\bin>

PS C:\Users\LSGX\Desktop\xxx\bin> .\nswl.exe -addns -f .\log.conf

NSIP:192.168.195.91

userid:nsroot

password:Done !!

PS C:\Users\LSGX\Desktop\xxx\bin>

PS C:\Users\LSGX\Desktop\xxx\bin> .\nswl.exe -start -f .\log.conf

log.conf 文件内容

##########

# This is the NSWL configuration file

# Only the default filter is active

# Remove leading # to activate other filters

##########

##########

# Default filter (default on)

# W3C Format logging, new file is created every hour or on reaching 10MB file size,

# and the file name is Exyymmdd.log

##########

Filter default 

begin default

	logFormat		W3C

	logInterval		Hourly

	logFileSizeLimit	10

	logFilenameFormat	Ex%{%y%m%d}t.log

end default

##########

# Netscaler caches example

# CACHE_F filter covers all the transaction with HOST name www.netscaler.com and the listed server ip's

##########

#Filter CACHE_F HOST www.netscaler.com IP 192.168.100.89 192.168.100.95 192.168.100.52 192.168.100.53 ON

##########

# Netscaler origin server example

# Not interested in Origin server to Cache traffic transaction logging

##########

#Filter ORIGIN_SERVERS IP 192.168.100.64 192.168.100.65 192.168.100.66 192.168.100.67 192.168.100.225 192.168.100.226 192.168.100.227 192.168.100.228 OFF

##########

# Netscaler image server example

# all the image server logging.

##########

#Filter IMAGE_SERVER HOST www.netscaler.images.com IP 192.168.100.71 192.168.100.72 192.168.100.169 192.168.100.170 192.168.100.171 ON

##########

# NCSA Format logging, new file is created every day midnight or on reaching 20MB file size,

# and the file name is /datadisk5/NETSCALER/log/NS<hostname>/Nsmmddyy.log.

# Exclude objects that ends with .gif .jpg .jar.

##########

#begin ORIGIN_SERVERS

#	logFormat 		NCSA

#	logInterval 		Daily

#	logFileSizeLimit 	40

#	logFilenameFormat 	/datadisk5/ORGIN/log/%v/NS%{%m%d%y}t.log

#	logExclude		.gif .jpg .jar

#end ORIGIN_SERVERS

##########

# NCSA Format logging, new file is created every day midnight or on reaching 20MB file size,

# and the file name is /datadisk5/NETSCALER/log/NS<hostname>/Nsmmddyy.log with log record timestamp as GMT.

##########

#begin CACHE_F

#	logFormat 		NCSA

#	logInterval 		Daily

#	logFileSizeLimit 	20

#	logFilenameFormat /datadisk5/NETSCALER/log/%v/NS%{%m%d%y}t.log

#	logtime			GMT

#end CACHE_F

##########

# W3C Format logging, new file on reaching 20MB and the log file path name is

# atadisk6/NETSCALER/log/server's ip/Exmmyydd.log with log record timestamp as LOCAL.

##########

#begin IMAGE_SERVER

#	logFormat 		W3C

#	logInterval 		Size

#	logFileSizeLimit	20

#	logFilenameFormat /datadisk6/NETSCALER/log/%AEx%{%m%d%y}t

#	logtime			LOCAL

#end IMAGE_SERVER

##########

# Virtual Host by Name firm, can filter out the logging based on the host name by,

##########

#Filter VHOST_F IP 10.101.2.151 NETMASK 255.255.255.0

#begin VHOST_F

#	logFormat		W3C

#	logInterval		Daily

#	logFileSizeLimit	10

#	logFilenameFormat /ns/prod/vhost/%v/Ex%{%m%d%y}t

#end VHOST_F

########## END FILTER CONFIGURATION ##########

NSIP	172.16.201.185	username	nsroot	password	230:1>0:1754434651,>*4*71>+3,33=/>3=-1+2-:(5(2-5,9*952.>6=1>,<77,4+9/>457<531118*;*321+>)83360170<616<6>.=2?74+3731;.?5610(=)4)550)46=.8/1*?.9-2*;4:2>/77:*>191<71/323*7-=2058);.2,>6?297:/1.849-1001>-5.9)5+>2?-17=)34<4=54-7+1.:400?(027655:.46<-72>6=+446.343

启动 nswl 客户端程序：

注意：收集的内容会写入 Ex*.log 文件中。

查看收集的日志内容：

How To Customize NetScaler Web Logging

https://support.citrix.com/article/CTX227457

Created: 06 Sep 2017 | Modified: 27 Sep 2017

Objective

This article describes how to configure NetScaler Web Logging (NSWL) client and customize NSWL logging.

Instructions

Enabling web logging feature on the NetScaler

We can enable web logging feature using the command “enable ns feature WL” on cli or on gui by check the Web Logging in Advanced features:

Downloading NSWL client

Open the URL: https://www.citrix.com/downloads.html.
Log in to the site using your credentials.
Open the page for the required release number and build.
In the page, under Weblog Clients, click Download. The package has the name format as follows: Weblog-<release number>-<build number>.zip. In my case, it is nswl_win-11.1-52.13.

Installing NSWL client on Windows server

Extract the nswl_win-11.1-52.13.zip file from the package.
Copy the extracted file to a Windows system on which you want to install the NSWL client.
On the Windows system, unzip the file in a directory (referred as <NSWL-HOME>). The following directories are extracted: bin, etc, and samples.

At the command prompt, run the following command from the <NSWL-HOME>\bin directory:
nswl -install -f <directorypath>\log.conf

where, <directorypath> refers to the path of the configuration file (log.conf). By default, the file is in the <NSWL-HOME>\etc directory. However, you can copy the configuration file to any other directory.

Adding the NSIP

Run the command nswl –addns –f <directorypath>\log.conf (Please note that the nswl client logging only work with the nsroot user. So, always add userid as nsroot)
Once the NSIP has been added, you will see the entry in the bottom of the log.conf file (\etc\log.conf)
Verify if the log.conf file is correct using the command nswl –verify –f <directorypath>\log.conf
We can start the service using the command nswl –start –f <directorypath>\log.con
Once we start the service, the logs will get generated in the <NSWL-HOME>\bin directory

Customizing logging to get the client ip address on the nswl logs

By default the log format is w3c format.

The fields that we get in the w3c format are “date time c-ip cs-username sc-servicename s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status cs-bytes sc-bytes time-taken cs-version cs(User-Agent) cs(Cookie) cs(Referer)”

We can customize the logs as per the

To export the “X-Forwarded-For” field from the http header by the web logging feature, configure the Custom HTTP Request Header to “X-Forwarded-For” in the Global System Settings.

Then customize the log format to “custom %{%Y-%m-%d%H:%M:%S}t %a %u %S %A %p %m %U %q %s %j %J %T %H "%{user-agent}i" "%{cookie}i" "%{referer}i" "%{X-Forwarded-For}i" %T %M %e1 %e2”

================== End