How Do I Optimize Syslog Maintenance on Command Center?

Use Case

Jack is an administrator who uses Command Center as a Syslog server for collecting NetScaler logs. Since this is huge amount of data and would take up lot of resources on Command Center, he would like to know how to configure this feature optimally.

Command Center can act as a Syslog server for the NetScaler devices that are added on it for management purpose. To monitor syslog events, you need to first configure Command Center as the syslog server for the NetScaler devices. Once this configuration is complete, all syslog messages are directed from the NetScaler devices to the Command Center server. These syslog can then be seen on Command Center GUI under Fault module -> Syslog -> Logs.

Note: You can configure Command Center as a Syslog Server by configuring appropriate Syslog policies from your NetScaler GUI (under Auditing). Apart from this traditional way of configuration, you can also use a pre-configured task (NSConfigureSyslogServer Built-in-task) in Command Center which would perform the necessary configurations on your NetScaler and register Command Center as a syslog server on it.

Optimizing Syslog configuration on Command Center

Since Syslog consumes a lot of storage space, it is a good option to optimize the syslog settings on your Command Center. To minimize the storage consumed by syslog on Command Center you can configure the following options:

1. Configure optimal values for syslog purge settings

2. Configure filters to suppress/discard the syslog you do not want to receive

Configuration Steps

Configure optimal values for syslog purge settings

On Command Center GUI: Go to Administration-> Settings-> Syslog Purge Settings and modify the purging interval to an optimal value. Larger value would result in a huge syslog data being stored in the database. You may modify this interval to a lesser value as per your needs so as to optimize the storage space consumed.

Configure filters to suppress/discard the syslog you do not want to receive

On Command Center GUI: Go to Fault -> Syslog -> Supress Logs. Here you can create a filter to discard the type of syslog messages that you do not want to maintain.?? After you create the filter, the Command Center server discards the incoming syslog that meet the criteria you specified.??Similar options are available for AppFirewall Syslog as well as NetScaler Gateway Syslog.

Conclusion

Syslog is one of the features on Citrix Command Center that, if enabled, consumes a lot of storage space and may lead to storage space issues if not configured optimally. Once you are done configuring syslog purging interval and/or creating filters to discard unnecessary syslog, maintaining syslog via Citrix Command Center will be a smooth activity.
??