How to find out, when a STA went down on Citrix NetScaler ADC


Recently, I came across a question: When did the STA go down? How can we find out?

Well, that’s easy to tell, as it gets logged. Unfortunately, the log isn’t that easy to understand. And, of course, like all logs in Citrix NetScaler, it disappears in a bit more than a day due to logfile rollover.

Where do we search for these logs?

Like always, my first source is Syslog. In a professional environment, following Citrix’s leading practices, you will have an external logging solution like Splunk, Solarwinds, Citrix ADM and many more. Go there!

If you don’t, you will have to open the BSD shell and search within /var/log/ns.log

What do these logs look like?

STA going up:

Jul 26 10:03:48 <> 07/26/2023:10:03:48 GMT 0-PPE-0 : default EVENT MONITORUP 54121 0 : Monitor MonServiceBinding_192.168.0.11:80_(sta)(internal) - State UP

STA going down:

Jul 26 10:09:52 <> 07/26/2023:10:09:52 GMT 0-PPE-0 : default EVENT MONITORDOWN 54705 0 : Monitor MonServiceBinding_192.168.0.11:80_(sta)(internal) - State DOWN

So you have to search for the string MonServiceBinding.

Understanding these logs:

My NSIP is Like all traffic originating from NetScaler, STA traffic comes from NSIP. And my STA is I used HTTP on port 80, so that’s why STA’s name is The STA ID is not printed into the Syslog.

Old logs on Citrix NetScaler ADC

Citrix NetScaler ADC does logfile rollover every hour sharp, in case the log-file is greater than 100 kB. The old logs are called ns.log.0.gz to ns.log.25.gz. These log files are compressed files, so we need an other command to look into these:

zcat ns*.gz | grep MonServiceBinding

Another method

As Carl Stalhood pointed out, you could also see these events from Citrix NetScaler shell (not bash) by executing show ns events. Citrix Netscaler maintains an internal table on memory, which can keep latest 1024 events. Besides, if the Netscaler is rebooted or ‘save config’ command is executed, the internal table will be refreshed. (CTX564340)

About the author

Johannes Norz

Johannes Norz is a Citrix Certified Citrix Technology Advocate (CTA), Citrix Certified Instructor (CCI) and Citrix Certified Expert on Application Delivery and Security (CCE-AppDS).

He frequently works for Citrix international Consulting Services and several education centres all around the globe.

Johannes lives in Austria. He had been borne in Innsbruck, a small city (150.000 inhabitants) in the middle of the most beautiful Austrian mountains (

Add comment

Recent Posts

Recent Comments