almost-syslog Citrix parser fails with CITRIX latest version 14.1

[yaks77]

Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to this guide.

Was the issue replicated by support?
the syslog parser app-almost-syslog-citrix_netscaler.conf is not capable to process CITRIX syslog events generated with the CITRIX latest version 14.1. that version generates RFC5424 compliant logs.

What is the sc4s version ?
3.37

Which operating system (including its version) are you using for hosting SC4S?
Red Hat Enterprise Linux release 8.10 (Ootpa)

Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S?
podman

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?
yes

single_packet.zip

Is the issue related to the environment of the customer or Software related issue?
no
Is it related to Data loss, please explain ?
Protocol? Hardware specs?
no
Last chance index/Fallback index?
due to the wrong parsing the CITRIX events are sent to nix index with wrong sc4s tags
sc4s_tags | wireformat:rfc|wireformat:rfc5424|.app.app-fallback-nix_syslog|.source.s_DEFAULT |  
sc4s_vendor | nix |  
source | program:SSLLOG |  
sourcetype | nix:syslog
Is the issue related to local customization?
no
Do we have all the default indexes created?
yes
Describe the bug
the current citrix parser present in SC4S does not support RFC5424 format used by the latest version of CITRIX 14.1

To Reproduce
Steps to reproduce the behavior:

1. Configure a citrix ADC VM
2. to have a working SC4S server
3. configure syslog to use UDP/TCP and RFC5424 (only option available) to be sent to SC4S
4. check logs in splunk

[yaks77]

with the incredible help of @ryanfaircloth (thanks a lot) I managed to fix this issue with the follwoing custom parser

block parser app-citrix-ns_rfc5424() {
 channel {
        rewrite {
            r_set_splunk_dest_default(
                index('netfw')
                sourcetype('citrix:netscaler:syslog')
                vendor('citrix')
                product('netscaler')
            );
        };
   };
};
application app-citrix-ns_rfc5424[sc4s-syslog] {
        filter {
        match('^\d+-PPE-' value('PID'));
    };

    parser { app-citrix-ns_rfc5424(); };
};

[Kawron]

Hi, @yaks77. We could implement a parser for the new version of Citrix, but we cannot use the same filter as you've used due to possible conflicts with other logs. We could, however, create a netsource parser that would match the RFC5424 Citrix logs based on the SC4S port. So you would have to specify a custom port for this traffic and then send RFC5424 data to it. Would this solution work for you?

[yaks77]

hi @Kawron , thanks a lot for all the effort. it is perfect, no problem at all to have to specify a custom port. did you push the change to the main branch? which version should I have to test it? many thanks once again.

[Kawron]

Hi @yaks77, I've just merged those changes to develop branch. If you are using docker, you can pull newest image with this command: docker pull ghcr.io/splunk/splunk-connect-for-syslog/container3:develop. Also, I've updated the documenation, but make sure to select develop branch at the top.

This change will be of course part of the next release.

Also, I'm also closing this issue as a duplicate: #2791.

[yaks77]

thanks a lot. could you tell me where is the new documentation? I dont see it in the usual url https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/Citrix/netscaler/ thanks

…

On Wed, 11 Feb 2026 at 11:18, Karol Wrona ***@***.***> wrote: *Kawron* left a comment (splunk/splunk-connect-for-syslog#2776) <#2776 (comment)> Hi @yaks77 <https://github.com/yaks77>, I've just merged those changes to develop branch. If you are using docker, you can pull newest image with this command: docker pull ghcr.io/splunk/splunk-connect-for-syslog/container3:develop. Also, I've updated the documenation, but make sure to select develop branch at the top. This change will be of course part of the next release. Also, I'm also closing this issue as a duplicate: #2791 <#2791>. — Reply to this email directly, view it on GitHub <#2776 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFOPUCQQLLUA5IGCKSOFDXD4LL6WBAVCNFSM6AAAAACSIQCVEKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQOBTGQ4TQOBXG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Kawron]

Sure, you need to make sure you are on documentation for develop branch. Try this link: splunk.github.io.

[Kawron]

Also, I can't help you with upgrading technical addon as this repo is only for sc4s

[yaks77]

Hi @Kawron ,
I just upgraded my SC4S installation to version 4.24.0 where I see that your changes were merged, and I found two issues.

1. I think there is a typo in the Sourcetype and Index configuration. The column key is the same for all three row, and this that not make any sense to me. So far I converted the first two rows of that table into two lines in splunk_metadata.csv, but there are 4 more lines on the table to be added with the same key. I didnt do that to prevent overwrite.

citrix_netscaler,sourcetype,citrix:netscaler:syslog
citrix_netscaler,index,netfw

I think that table should have three different keys, one per row.

2. I configured port 5515 in CITRIX appliances and I selected to log everything possible. Also, I added the required CITRIX parameters in the env_file as well.

SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER=yes
SC4S_LISTEN_CITRIX_NETSCALER_RFC5424_UDP_PORT=5514

After doing all these, I see CITRIX logs reaching splunk which means they successfully went thorugh SC4S. Unfortunately the event does not have much valuable information extracted from CITRIX syslog event, maybe due to the typo I mentioned above.

What do you think? Many thanks in advance.
Best,
Jose

note: I installed the Add-on mentioned in the official documentation in both indexer and searchead.
https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/Citrix/netscaler/