Monitoring, troubleshooting, and optimization
What this domain tests
This domain tests operational diagnosis and performance tuning: how to collect evidence, read ADC health, and apply optimization features without breaking traffic.
Core rules
- Monitoring sources include the dashboard, SNMP traps, syslog, audit logs, AppFlow, and NetScaler Insight. AppFlow exports flow records to a collector; it is not enabled by default.
- nstrace captures packets on the ADC. Use filters and capture modes to limit size; the trace can be downloaded and read in Wireshark. nsconmsg reads counters.
- Useful commands: show lb vserver, show service, show servicegroup, show ssl certKey, show gslb site, show ha node, stat, and ping/telnet from the ADC.
- Optimization features include compression, caching, TCP profiles, HTTP/2, front-end optimization, and surge protection. Compression reduces bandwidth; caching stores static objects.
- TCP profiles tune window scaling, SACK, and buffer behavior. The default profile is conservative; a custom profile may improve long-fat-network throughput.
- High CPU can come from SSL handshakes, compression, or a busy packet engine; check per-PE stats.
Worked example
Users report slow downloads through an ADC. nstrace shows many retransmissions and a small TCP window from the ADC to clients on a high-latency link. Reasoning: the default TCP profile may not scale windows enough for long RTT. Create a custom TCP profile with larger buffers and window scaling, bind it to the LB vserver, and test. If CPU rises after enabling compression, check whether the traffic is already compressed or encrypted; compressing SSL payloads after termination can help, but compressing already compressed content wastes CPU. Confirm the bottleneck with counters before changing profiles.
Traps that cost marks
nstrace can fill disk or add CPU load; use filters. SNMP must be configured with a community or user and allowed by management ACLs. AppFlow needs a collector and a configured export policy. Compression is not a substitute for a larger circuit and can be ineffective for media. Do not tune a TCP profile globally without testing; bind it to the specific vserver.