Skip to content


The following operations can be performed on "audit":

stat audit

Display the audit statistics


stat audit [-detail] [-fullValues] [-ntimes ] [-logFile ] [-clearstats ( basic | full )]


detail Specifies detailed output (including more statistics). The output can be quite voluminous. Without this argument, the output will show only a summary.

fullValues Specifies that numbers and strings should be displayed in their full form. Without this option, long strings are shortened and large numbers are abbreviated

ntimes The number of times, in intervals of seven seconds, the statistics should be displayed. Default value: 1 Minimum value: 0

logFile The name of the log file to be used as input.

clearstats Clear the statsistics / counters

Possible values: basic, full



Logs sent to syslog server(UDP) (LogSnd) Syslog messages sent to the syslog server(s) over UDP.

Audit log messages generated (LogGen) Syslog messages about to be sent to the syslog server.

Logs sent to syslog server(TCP) (LogSndTcp) Syslog messages sent to the syslog server(s) over TCP.

NAT allocation failed (Ernatpcb) NAT allocation failed.

Nsb allocation failed (Ernsb) Nsb allocation failed.

Memory allocation failed (Ermem) Failures in allocation of Access Gateway context structure. When an Access Gateway session is established, the Citrix ADC creates an internal context structure , which identifies the user and the IP address from which the user has logged in.

Port allocation failed (Erport) Number of times the Citrix ADC failed to allocate a port when sending a syslog message to the syslog server(s).

Context not found (Ctxntfnd) Failures in finding the context structure for an Access Gateway session during attempts to send session-specific audit messages.

During an Access Gateway session, audit messages related to the session are queued up in the auditlog buffer for transmission to the audit log server(s). If the session is killed before the messages are sent, the context structure allocated at session creation is removed. This structure is needed for sending the queued auditlog messages. If it is not found, this counter is incremented.

Nsb chain allocation failed (Ernsbchn) Nsb Chain allocation failed.

Client connect failed (Erclconn) Failures in establishment of a connection between the Citrix ADC and the auditserver tool (the Citrix ADC's custom logging tool).

MP buffer flush command count (flcmdcnt) Auditlog buffer flushes. In a multiprocessor Citrix ADC, both the main processor and the co-processor can generate auditlog messages and fill up the auditlog buffers. But only the primary processor can free up the buffers by sending auditlog messages to the auditlog server(s). The number of auditlog buffers is fixed. If the co-processor detects that all the auditlog buffers are full, it issues a flush command to the main processor.

TCP connect failed for syslog (Ersystcpconn) Failures in establishment of a connection between the Citrix ADC and the syslog server.

Logs unsent to LB syslog server (LogUnsentLBsys) Total auditlog messages which are not delivered to load balanced syslog servers

Logs dropped(max hold limit) (DroppedLogsCnt) Total number of log messages dropped by Citrix ADC after max hold limit is reached

Logs dropped(TX min NSBS) (DroppedLogsCntTxMinNSBs) Total number of log messages dropped by Citrix ADC when NSBQ length is less than TX min NSBs

Was this article helpful?