Netscaler Knowledgebase

The netscaler logs are binary (ie non-human readable) so you have to use the netscaler application "nsconmsg" to extract information. There are many options for the command, and about the only documentation I've ever seen is in the netscaler training course manual!

Many of the commands should only be entered on the day of the full moon, or by people who have scored in excess of 98% in the netscaler exam :-)

Let me cut & paste some examples....

If you want to:
Uncompress an archived log file:   
  gunzip newnslog.21.gz
Discover the time period covered by the log:   
  nsconmsg -K newnslog.21 –d setime
View load-balancing statistics from the archived log: 
  nsconmsg -K newnslog.21 -s ConLb=2 -d oldconmsg
Extract logging information for a shorter duration:   
  nsconmsg -K newnslog.21 -s time=12Jan2006:00:00 -k short_log.nsl -T 1200 -d copy
Start the log process for newnslog:   
  nsconmsg -k /var/nslog/newnslog -T 172800 &

If you want to:
View the time span of the current newnslog file:
nsconmsg -K newnslog -d setime
View the time span of the archived newnslog file:
  zcat filename | nsconmsg -K pipe -d setime
View events in the current newnslog file:
  nsconmsg -K newnslog -d event
View console messages in the current newnslog file:
  nsconmsg -K newnslog -d consmsg
View counter values in the current newnslog file:
  nsconmsg -K newnslog -d stats
View counter values in the current newnslog file:
  nsconmsg -K newnslog -d stats –d current
View non-zero counter values in the current newnslog file:
  nsconmsg -K newnslog -d statswt0 –d current

to display event information, such as entity up/down, alerts and configuration saves in the shell:
  nsconmsg -K newnslog -d event

to display CPU usage in the shell:
  nsconmsg -K newnslog -s totalcount=200 -g cpu_use -d current

to display memory utilization in the shell:
  nsconmsg -s ConMEM=1 -d oldconmsg

to display established HTTP connections in the shell:
  nsconmsg -j server_NSSVC_HTTP_vserver -d current
to display load balancing statistics in the shell:
  nsconmsg -K newnslog –s ConLb=x –d oldconmsg
This command gives basic information when x=1 and detailed information when x=2.

use the following command to view traffic distribution from the shell.
  nsconmsg -K /var/nslog/newnslog -s time -s ConLB=2 -2 distrconmsg

to display load-balancing information in the shell.
  nsconmsg -s ConLb=1 -d oldconmsg

to display monitoring statistics in the shell.
  nsconmsg -K newnslog –s ConMon=x –d oldconmsg
This command gives basic information when x=1 and gives detailed information when x=2.

if you want to:
View SSL stats for front-end connections:
  nsconmsg -K newnslog -s ConSSL=1 -d oldconmsg
View SSL stats for back-end connections:
  nsconmsg -K newnslog -s ConSSL=2 -d oldconmsg
View SSL stats for front and back-end connections:
  nsconmsg -K newnslog -s ConSSL=3 -d oldconmsg

to display content switching statistics in the shell.
  nsconmsg -K newnslog –s ConCSW=1 -d oldconmsg

to display compression statistics in the shell.
  nsconmsg -K newnslog –s ConCMP=x -d oldconmsg
This command gives old compression method related statistics when x=1 and gives new compression method related statistics when x=2

to display integrated caching statistics in the shell.
  nsconmsg -K newnslog -s ConIC=1 -d oldconmsg

excelent tips!!!

they are really good tips! by the way, where did your learned this? I need to check if anyone logged to the admin console and I cannot find the way to get it using the newsnslog....

thanks

Some of this probably duplicates my original post.... here's some bits stolen from the Netscaler Advanced course.....

Enter the following command in the shell to trim a newnslog file:
  nsconmsg -K input_file -s time=DDMMMYYYY:HH:MM -k output_file -T seconds -d copy
Command example:
  nsconmsg -K /var/nslog/newnslog -s time=19Jan2009:17:00 -k slice1_newnslog -T 3600 -d copy
This command writes newnslog entries from 5pm-6pm in the slice1_newnslog file.

Enter the following command in the shell to view the time span of the current newnslog file:
  nsconmsg -K /var/nslog/newnslog -d setime

Enter the following command in the shell to display event information, such as entity up/down, alerts and configuration saves:
  nsconmsg -K /var/nslog/newnslog -d event

Enter the following command in the shell to view console messages, which include IP address conflicts and duplex mismatch, in the current newnslog file:
  nsconmsg -K /var/nslog/newnslog -d consmsg

Enter the following command in the shell to display memory utilization:
  nsconmsg -s -K /var/nslog/newnslogConMEM=1 -d oldconmsg

Enter the following command in the shell to display bandwidth information:
  nsconmsg -K /var/nslog/newnslog -s nsdebug_pe=1 -d oldconmsg

Enter the following command in the shell to display load-balancing information:
  nsconmsg -K /var/nslog/newnslog -s ConLb=1 -d oldconmsg

Enter the following command in the shell to view SSL stats for front-end connections:
  nsconmsg -K /var/nslog/newnslog -s ConSSL=1 -d oldconmsg

Enter the following command in the shell to view SSL stats for back-end connections:
  nsconmsg -K /var/nslog/newnslog -s ConSSL=2 -d oldconmsg

Enter the following command in the shell to view SSL stats for front- and back-end connections:
  nsconmsg -K /var/nslog/newnslog -s ConSSL=3 -d oldconmsg

Enter the following command in the shell to display monitoring statistics:
  nsconmsg -K /var/nslog/newnslog –s ConMon=x –d oldconmsg
This command gives basic information when x=1 and gives detailed information when x=2.

Enter the following command in the shell to display content switching statistics:
  nsconmsg -K /var/nslog/newnslog –s ConCSW=1 -d oldconmsg

Enter the following command in the shell to view all non-zero totals in the current newnslog file:
  nsconmsg -K /var/nslog/newnslog -d statswt0 | more

Enter the following command in the shell to view the average rates in the current newnslog file:
  nsconmsg -K /var/nslog/newnslog –d current | more

Use -g to grep for specific counters of interest. For example:
  nsconmsg -K /var/nslog/newnslog -g cpu -d statswt0 | more
  nsconmsg -K /var/nslog/newnslog -g arp –d current | more

Enter following command in the shell to display CPU usage in the shell:
  nsconmsg -K /var/nslog/newnslog -s totalcount=200 -g cpu_use -d current

Enter the following command in the shell to display NIC information:
  nsconmsg -K /var/nslog/newnslog -g nic -d current


And watch out for the parameters: a "-k" and a "-K" (lower- vs upper-case) have VERY different meanings!!!! For example the UPPERcase "-K" refers to an input file, whilst the lowercase "-k" refers to an output file. Getting them wring could mean over-writing your log file!!! Ooops!