Recently, I came across a question: When did the STA go down? How can we find out?
Well, that’s easy to tell, as it gets logged. Unfortunately, the log isn’t that easy to understand. And, of course, like all logs in Citrix NetScaler, it disappears in a bit more than a day due to logfile rollover.
Where do we search for these logs?
Like always, my first source is Syslog. In a professional environment, following Citrix’s leading practices, you will have an external logging solution like Splunk, Solarwinds, Citrix ADM and many more. Go there!
If you don’t, you will have to open the BSD shell and search within /var/log/ns.log
What do these logs look like?
STA going up:
Jul 26 10:03:48 <local0.info> 192.168.20.100 07/26/2023:10:03:48 GMT 0-PPE-0 : default EVENT MONITORUP 54121 0 : Monitor MonServiceBinding_192.168.0.11:80_(sta)(internal) - State UP
STA going down:
Jul 26 10:09:52 <local0.info> 192.168.20.100 07/26/2023:10:09:52 GMT 0-PPE-0 : default EVENT MONITORDOWN 54705 0 : Monitor MonServiceBinding_192.168.0.11:80_(sta)(internal) - State DOWN
So you have to search for the string MonServiceBinding.
Understanding these logs:
My NSIP is 192.168.20.100. Like all traffic originating from NetScaler, STA traffic comes from NSIP. And my STA is 192.168.0.11. I used HTTP on port 80, so that’s why STA’s name is 192.168.0.11:80. The STA ID is not printed into the Syslog.
Old logs on Citrix NetScaler ADC
Citrix NetScaler ADC does logfile rollover every hour sharp, in case the log-file is greater than 100 kB. The old logs are called ns.log.0.gz to ns.log.25.gz. These log files are compressed files, so we need an other command to look into these:
zcat ns*.gz | grep MonServiceBinding
Another method
As Carl Stalhood pointed out, you could also see these events from Citrix NetScaler shell (not bash) by executing show ns events. Citrix Netscaler maintains an internal table on memory, which can keep latest 1024 events. Besides, if the Netscaler is rebooted or ‘save config’ command is executed, the internal table will be refreshed. (CTX564340)
