Accenture MDR Quick Start Guide for Citrix® NetScaler Logging Configuration

This quick start guide will help Accenture MDR customers configure Citrix® NetScaler to send logs to the Log Collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Citrix NetScaler VPX

To configure the Citrix NetScaler VPX to send logs to the LCP, follow the steps below.

1. Verify if the hostname is configured.

• Login to the NetScaler Web interface as an Administrator.

• Navigate to Configuration > Settings.

Open

• Click on Host Name, DNS IP Address and Time Zone.

Open

• In the Host Name text box, verify if the host name is present.

2. Configure the Syslog server action.

• Login to the NetScaler Web interface as an Administrator.

• Go to Configuration > System > Auditing > Syslog > Servers.

3. Do the following steps to Create Auditing Server window. 

• Enter the Syslog details like Name, Server Type, IP address of the LCP and Port.

• Select Log Levels as Custom.

• Enable all checkboxes except DEBUG level in the configuration.

• Select LOCAL0 from Log Facility drop-down.

• Select MMDDYYYY from Date Format drop-down.

• Select Time Zone as GMT.

• Uncheck all the check boxes as per below screenshot.

• Click OK to create the auditing server.

4. Binding the created audit policy to the server.

• Go to Configuration > System > Auditing > Syslog and click the Policies tab.

• In the Name* text box, type a name for the policy.

• In the Server* drop-down list, select the policy from the previous section and click Create.

5. Right-click the created Auditing Policy and go to Action > Global Bindings and click Add Binding. 

6. In the Policy Binding window,

• In the Select Policy* text box, type the created audit policy.

• In the Binding Details section, in the Priority* text box,  type 120 as it is the default priority and click Bind.

 Note: Priority is a numeric value that indicates when this policy is evaluated relative to other policies. Access Gateway gives precedence to a policy with lower priority.

Configuring Citrix NetScaler SDX

To configure the Citrix NetScaler SDX to send logs to the LCP, follow the steps below.

1. Verify if the hostname is configured.

   1. Login to the NetScaler Web interface as an Administrator.

   2. Navigate to System > System Settings

   3. In the Host Name text box, verify if the host name is present.

      1. If the host name is configured already, no action is required.

      2. If the text box is empty, type a host name without space.

2. Configure a syslog server.

   1. Navigate to System > Notifications > Syslog Servers.

   2. In the details pane, click Add.

   3. In the Create Syslog Server page, specify values for the syslog server parameters. Enter a Name, then LCP IP address, port number, Choose Log Level as ‘Custom' and select all log levels except Debug and then click 'Create’.

3. Configure the syslog parameters(date and time format).

   1. Navigate to System > Notifications > Syslog Servers.

   2. In the details pane, click Syslog Parameters.

   3. In the Configure Syslog Parameters page, select the date format ‘MMDDYYYY’ and select time format ‘GMT’. Click 'OK'.

LCP Configuration Parameters

Table 1-2: The Citrix NetScaler event collector (Syslog -3679) properties to be configured by MDR are shown in the table.