---
title: "network.citrix"
canonical: "https://docs.devo.com/space/latest/94664677/network.citrix"
format: markdown
---
> Macro (toc)

> ℹ️ Check the reference vendor documentation [here](https://developer-docs.netscaler.com/en-us/netscaler-syslog-message-reference/current-release.html).

## Introduction

The tags beginning with `network.citrix` identify events generated by [Citrix](https://www.citrix.com) (formally known as Citrix NetScaler)

## Valid tags and data tables

<span style="color: #282828">The full tag must have 4 levels. The first two are fixed as</span><span style="color: #282828">** **</span>`network.citrix`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype.</span>

> ⚠️ If you need to parse any events with a subtype that is not included in the table below, please [contact us](mailto:support@devo.com) so we can analyze your case and create a dedicated parser.

| **Technology** | **Brand** | **Type** | **Subtype** |
| --- | --- | --- | --- |
| `network` | `citrix` | `adc` | - `aaa`
- `aaatm`
- `api`
- `cli`
- `event`
- `gui`
- `ica`
- `snmp`
- `ssllog`
- `sslvpn`
- `tcp`
- `other` |
| `netscaler` | `snmp` |

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Citrix ADC | `network.citrix.adc` | `network.citrix.adc` |
| `network.citrix.adc.aaa` | `network.citrix.adc.aaa` |
| `network.citrix.adc.aaatm` | `network.citrix.adc.aaatm` |
| `network.citrix.adc.api` | `network.citrix.adc.api` |
| `network.citrix.adc.appfw` | `network.citrix.adc.appfw` |
| `network.citrix.adc.cli` | `network.citrix.adc.cli` |
| `network.citrix.adc.console` | `network.citrix.adc.console` |
| `network.citrix.adc.event` | `network.citrix.adc.event` |
| `network.citrix.adc.gui` | `network.citrix.adc.gui` |
| `network.citrix.adc.ica` | `network.citrix.adc.ica` |
| `network.citrix.adc.nswl` | `network.citrix.adc.nswl` |
| `network.citrix.adc.other` ** | `network.citrix.adc.other` |
| `network.citrix.adc.snmp` | `network.citrix.adc.snmp` |
| `network.citrix.adc.ssllog` | `network.citrix.adc.ssllog` |
| `network.citrix.adc.sslvpn` | `network.citrix.adc.sslvpn` |
| `network.citrix.adc.tcp` | `network.citrix.adc.tcp` |
| Citrix NetScaler | `network.citrix.netscaler.event` | `network.citrix.netscaler.event` |
| `network.citrix.netscaler.misc` | `network.citrix.netscaler.misc` |
| `network.citrix.netscaler.snmp` | `network.citrix.netscaler.snmp` |
| `network.citrix.netscaler.tcp` | `network.citrix.netscaler.tcp` |

** For any other `network.citrix.adc` logs, use `network.citrix.adc.other` table.

## <span style="color: #282828">How is the data sent to Devo?</span>

Logs generated by Cisco must be sent to the Devo platform via the<span style="color: #003366">[ Devo Relay ](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96468993)</span>to secure communication. See the required <span style="color: #003366">[relay rule](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469377)</span><span style="color: #003366"> </span>below:

- **Source port **→ Set as required
- **Source data** → `default (\S+)`
- **Target tag** → `network.citrix.adc.\\d1`
- **Target message*** → *`\\d0`

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [network.citrix.adc](#network.citrix.adc)
> - [network.citrix.adc.aaa](#network.citrix.adc.aaa)
> - [network.citrix.adc.aaatm](#network.citrix.adc.aaatm)
> - [network.citrix.adc.api](#network.citrix.adc.api)
> - [network.citrix.adc.event](#network.citrix.adc.event)
> 
> ### > Macro (anchor)
> 
> network.citrix.adc
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *type* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.aaa
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *user* | `str` |  |
> | *browser* | `str` |  |
> | *clientIp* | `ip4` |  |
> | *vserverIp* | `ip4` |  |
> | *failureReason* | `str` |  |
> | *extractedGroups* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.aaatm
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *host* | `str` |  |  |  |
> | *serverdate* | `str` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *subtype* | `str` |  |  |  |
> | *identifier* | `str` |  |  |  |
> | *user* | `str` |  |  |  |
> | *browser* | `str` |  |  |  |
> | *clientIp* | `ip4` |  |  |  |
> | *natIpStr* | `str` |  |  |  |
> | *natIp* | `ip4` | ```
> ip4(split(natIpStr, ":", 0))
> ``` | *natIpStr* |  |
> | *natPort* | `int4` | ```
> int4(split(natIpStr, ":", 1))
> ``` | *natIpStr* |  |
> | *vserverIp* | `ip4` |  |  |  |
> | *vserverPort* | `int4` |  |  |  |
> | *groups* | `str` |  |  |  |
> | *startTime* | `str` |  |  |  |
> | *endTime* | `str` |  |  |  |
> | *duration* | `str` |  |  |  |
> | *httpResourcesAccessed* | `str` |  |  |  |
> | *deniedByPolicy* | `str` |  |  |  |
> | *logoutMethod* | `str` |  |  |  |
> | *message* | `str` |  |  |  |
> | *rawMessage* | `str` |  |  | **✓** |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.api
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *user* | `str` |  |
> | *remoteIp* | `ip4` |  |
> | *command* | `str` |  |
> | *status* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.event
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [network.citrix.adc.gui](#)
> - [network.citrix.adc.routing](#network.citrix.adc.routing)
> - [network.citrix.adc.ssllog](#network.citrix.adc.ssllog)
> - [network.citrix.adc.sslvpn](#network.citrix.adc.sslvpn)
> - [network.citrix.adc.tcp](#network.citrix.adc.tcp)
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.gui
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *user* | `str` |  |
> | *remoteIp* | `ip4` |  |
> | *command* | `str` |  |
> | *status* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.routing
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.ssllog
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *sessionId* | `str` |  |
> | *user* | `str` |  |
> | *clientIp* | `ip4` |  |
> | *clientPort* | `int4` |  |
> | *SPCBId* | `str` |  |
> | *natIp* | `ip4` |  |
> | *vserverIp* | `ip4` |  |
> | *vserverPort* | `int4` |  |
> | *crlName* | `str` |  |
> | *domainName* | `str` |  |
> | *ipAddress* | `str` |  |
> | *clientVersion* | `str` |  |
> | *cipherSuite* | `str` |  |
> | *handshakeTime* | `int8` |  |
> | *session* | `str` |  |
> | *issuerName* | `str` |  |
> | *serverIp* | `ip4` |  |
> | *serverPort* | `int4` |  |
> | *protocolVersion* | `str` |  |
> | *serialNumber* | `str` |  |
> | *signatureAlgorithm* | `str` |  |
> | *validFrom* | `str` |  |
> | *validTo* | `str` |  |
> | *reason* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.sslvpn
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *sessionId* | `str` |  |
> | *user* | `str` |  |
> | *domain* | `str` |  |
> | *natIp* | `ip4` |  |
> | *clientIp* | `ip4` |  |
> | *clientPort* | `int4` |  |
> | *vserverIp* | `ip4` |  |
> | *vserverPort* | `int4` |  |
> | *sourceIp* | `ip4` |  |
> | *sourcePort* | `int4` |  |
> | *destinationIp* | `ip4` |  |
> | *destinationPort* | `int4` |  |
> | *startTime* | `str` |  |
> | *endTime* | `str` |  |
> | *delinkTime* | `str` |  |
> | *duration* | `str` |  |
> | *bytesSend* | `int8` |  |
> | *bytesRecv* | `int8` |  |
> | *compressedBytesSend* | `int8` |  |
> | *compressedBytesRecv* | `int8` |  |
> | *compRatioSend* | `str` |  |
> | *compRatioRecv* | `str` |  |
> | *access* | `str` |  |
> | *groups* | `str` |  |
> | *session* | `str` |  |
> | *clientVersion* | `str` |  |
> | *cipherSuite* | `str` |  |
> | *handshakeTime* | `int8` |  |
> | *errMsg* | `str` |  |
> | *ssoIs* | `str` |  |
> | *httpRequest* | `str` |  |
> | *deniedByPolicy* | `str` |  |
> | *SPCBId* | `str` |  |
> | *subjectName* | `str` |  |
> | *applicationName* | `str` |  |
> | *browser* | `str` |  |
> | *sslvpnClientType* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.citrix.adc.tcp
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *host* | `str` |  |
> | *serverdate* | `str` |  |
> | *machine* | `str` |  |
> | *subtype* | `str` |  |
> | *identifier* | `str` |  |
> | *sourceIp* | `ip4` |  |
> | *sourcePort* | `int4` |  |
> | *startTime* | `str` |  |
> | *endTime* | `str` |  |
> | *vserverIp* | `ip4` |  |
> | *vserverPort* | `int4` |  |
> | *natIp* | `ip4` |  |
> | *natPort* | `int4` |  |
> | *destinationIp* | `ip4` |  |
> | *destinationPort* | `int4` |  |
> | *delinkTime* | `str` |  |
> | *bytesSend* | `int8` |  |
> | *bytesRecv* | `int8` |  |
> | *closureReason* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |