Back to Blog

powershell nobind syslog

Non classé Netscaler Master 
<pre class="wp-block-syntaxhighlighter-code"># ============================================================================
# Script d'analyse des Audit Syslog Actions et Policies NetScaler
# ============================================================================
# 
# But : Identifier les syslog actions et policies non utilisees
# - Une syslog action est inutilisee si elle n'est referencee par aucune policy
# - Une syslog policy est inutilisee si elle n'est pas bindee en global
#
# ============================================================================

# ========== CONFIGURATION ==========
# Modifiez cette ligne avec votre chemin vers ns.conf
$NS_CONF_PATH = "C:\logs\ns.conf"
# ====================================

# ============================================================================
# FONCTIONS PRINCIPALES
# ============================================================================

function Load-NSConf {
    param([string]$FilePath)
    
    if (Test-Path $FilePath) {
        Write-Host "`n[INFO] Chargement du fichier : $FilePath" -ForegroundColor Cyan
        return Get-Content -Path $FilePath -Encoding UTF8
    } else {
        Write-Host "`n[ERREUR] Le fichier $FilePath est introuvable !" -ForegroundColor Red
        exit 1
    }
}

function Get-SyslogActions {
    param([string[]]$Lines)
    
    $actions = @{}
    
    foreach ($line in $Lines) {
        # Recherche les lignes : add audit syslogAction <nom> ...
        if ($line -match '^add audit syslogAction\s+(\S+)') {
            $actionName = $Matches[1]
            $actions[$actionName] = $line
        }
    }
    
    return $actions
}

function Get-SyslogPolicies {
    param([string[]]$Lines)
    
    $policies = @{}
    
    foreach ($line in $Lines) {
        # Recherche les lignes : add audit syslogPolicy <nom> <expression> <action>
        if ($line -match '^add audit syslogPolicy\s+(\S+)\s+(.+?)\s+(\S+)') {
            $policyName = $Matches[1]
            $expression = $Matches[2]
            $actionName = $Matches[3]
            
            $policies[$policyName] = @{
                'Line' = $line
                'Expression' = $expression
                'Action' = $actionName
            }
        }
    }
    
    return $policies
}

function Get-SyslogPolicyBindings {
    param([string[]]$Lines)
    
    $bindings = @{
        'Global' = @()
    }
    
    foreach ($line in $Lines) {
        # Bind audit syslogGlobal -policyName <policy> -priority <X>
        if ($line -match '^bind audit syslogGlobal\s+-policyName\s+(\S+).*-priority\s+(\d+)') {
            $policyName = $Matches[1]
            $priority = $Matches[2]
            $bindings['Global'] += @{
                'Policy' = $policyName
                'Priority' = $priority
                'Line' = $line
            }
        }
    }
    
    return $bindings
}

function Get-UsedActions {
    param($Policies, $BoundPolicies)
    
    $usedActions = @{}
    
    # Ne compter que les actions référencées par des policies BINDÉES
    foreach ($policyName in $Policies.Keys) {
        # Vérifier si cette policy est bindée
        if ($BoundPolicies.ContainsKey($policyName)) {
            $actionName = $Policies[$policyName]['Action']
            if (-not $usedActions.ContainsKey($actionName)) {
                $usedActions[$actionName] = @()
            }
            $usedActions[$actionName] += $policyName
        }
    }
    
    return $usedActions
}

function Get-BoundPolicies {
    param($Bindings)
    
    $boundPolicies = @{}
    
    # Global bindings
    foreach ($binding in $Bindings['Global']) {
        $policyName = $binding['Policy']
        if (-not $boundPolicies.ContainsKey($policyName)) {
            $boundPolicies[$policyName] = @()
        }
        $boundPolicies[$policyName] += @{
            'Description' = "Global (Priority: $($binding['Priority']))"
            'Line' = $binding['Line']
        }
    }
    
    return $boundPolicies
}

# ============================================================================
# AFFICHAGE DES RESULTATS
# ============================================================================

function Show-UnusedActions {
    param($Actions, $UsedActions, $Policies, $BoundPolicies)
    
    Write-Host "`n==================================================================" -ForegroundColor Red
    Write-Host " SYSLOG ACTIONS NON UTILISEES" -ForegroundColor Red -BackgroundColor Black
    Write-Host "==================================================================" -ForegroundColor Red
    
    # Séparer les actions en deux catégories
    $orphanActions = @()  # Aucune policy ne les référence
    $unboundPolicyActions = @{}  # Référencées par des policies non bindées
    
    foreach ($actionName in $Actions.Keys) {
        if (-not $UsedActions.ContainsKey($actionName)) {
            # Cette action n'est pas utilisée
            # Vérifier si elle est référencée par des policies (non bindées)
            $referencedBy = @()
            foreach ($policyName in $Policies.Keys) {
                if ($Policies[$policyName]['Action'] -eq $actionName) {
                    # Cette policy référence l'action
                    if (-not $BoundPolicies.ContainsKey($policyName)) {
                        # Et cette policy n'est pas bindée
                        $referencedBy += $policyName
                    }
                }
            }
            
            if ($referencedBy.Count -eq 0) {
                # Vraiment orpheline
                $orphanActions += $actionName
            } else {
                # Référencée par des policies non bindées
                $unboundPolicyActions[$actionName] = $referencedBy
            }
        }
    }
    
    $totalUnused = $orphanActions.Count + $unboundPolicyActions.Count
    
    if ($totalUnused -eq 0) {
        Write-Host "`nAucune syslog action inutilisee trouvee !" -ForegroundColor Green
    } else {
        Write-Host "`nNombre d'actions non utilisees : $totalUnused" -ForegroundColor Red
        
        # Afficher les actions orphelines
        if ($orphanActions.Count -gt 0) {
            Write-Host "`n[1] Actions orphelines (aucune policy ne les reference) : $($orphanActions.Count)" -ForegroundColor Yellow
            
            foreach ($actionName in ($orphanActions | Sort-Object)) {
                Write-Host "  ├─ " -NoNewline -ForegroundColor Red
                Write-Host "$actionName" -ForegroundColor Red
                Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
                Write-Host "$($Actions[$actionName])" -ForegroundColor White
                Write-Host "  │" -ForegroundColor DarkGray
                Write-Host "  │  Commande de suppression :" -ForegroundColor DarkGray
                Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
                Write-Host "rm audit syslogAction $actionName" -ForegroundColor White
                Write-Host "  │" -ForegroundColor DarkGray
            }
            Write-Host "  └─────────────────────────────────────────────────────────────" -ForegroundColor Red
        }
        
        # Afficher les actions référencées par policies non bindées
        if ($unboundPolicyActions.Count -gt 0) {
            Write-Host "`n[2] Actions referencees par policies non bindees : $($unboundPolicyActions.Count)" -ForegroundColor Yellow
            
            foreach ($actionName in ($unboundPolicyActions.Keys | Sort-Object)) {
                Write-Host "  ├─ " -NoNewline -ForegroundColor Red
                Write-Host "$actionName" -ForegroundColor Red
                Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
                Write-Host "$($Actions[$actionName])" -ForegroundColor White
                Write-Host "  │" -ForegroundColor DarkGray
                Write-Host "  │  Referencee par les policies (non bindees) :" -ForegroundColor DarkGray
                foreach ($policyName in $unboundPolicyActions[$actionName]) {
                    Write-Host "  │    • " -NoNewline -ForegroundColor DarkGray
                    Write-Host "$policyName" -ForegroundColor Yellow
                }
                Write-Host "  │" -ForegroundColor DarkGray
                Write-Host "  │  Commande de suppression :" -ForegroundColor DarkGray
                Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
                Write-Host "rm audit syslogAction $actionName" -ForegroundColor White
                Write-Host "  │" -ForegroundColor DarkGray
            }
            Write-Host "  └─────────────────────────────────────────────────────────────" -ForegroundColor Red
        }
    }
}

function Show-UnusedPolicies {
    param($Policies, $BoundPolicies)
    
    Write-Host "`n==================================================================" -ForegroundColor Red
    Write-Host " SYSLOG POLICIES NON BINDEES" -ForegroundColor Red -BackgroundColor Black
    Write-Host "==================================================================" -ForegroundColor Red
    
    $unusedPolicies = @()
    
    foreach ($policyName in $Policies.Keys) {
        if (-not $BoundPolicies.ContainsKey($policyName)) {
            $unusedPolicies += $policyName
        }
    }
    
    if ($unusedPolicies.Count -eq 0) {
        Write-Host "`nAucune syslog policy non bindee trouvee !" -ForegroundColor Green
    } else {
        Write-Host "`nNombre de policies non bindees : $($unusedPolicies.Count)" -ForegroundColor Red
        Write-Host "Ces policies ne sont pas bindees en global :`n" -ForegroundColor Yellow
        
        foreach ($policyName in ($unusedPolicies | Sort-Object)) {
            $policy = $Policies[$policyName]
            Write-Host "  ├─ " -NoNewline -ForegroundColor Red
            Write-Host "$policyName" -ForegroundColor Red
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "Action utilisee : " -NoNewline -ForegroundColor DarkGray
            Write-Host "$($policy['Action'])" -ForegroundColor Cyan
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "$($policy['Line'])" -ForegroundColor White
            Write-Host "  │" -ForegroundColor DarkGray
            Write-Host "  │  Commande de suppression :" -ForegroundColor DarkGray
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "rm audit syslogPolicy $policyName" -ForegroundColor White
            Write-Host "  │" -ForegroundColor DarkGray
        }
        Write-Host "  └─────────────────────────────────────────────────────────────" -ForegroundColor Red
    }
}

function Show-UsedActions {
    param($Actions, $UsedActions, $Policies)
    
    Write-Host "`n==================================================================" -ForegroundColor Green
    Write-Host " SYSLOG ACTIONS UTILISEES" -ForegroundColor Green -BackgroundColor Black
    Write-Host "==================================================================" -ForegroundColor Green
    
    $usedActionsList = @()
    
    foreach ($actionName in $Actions.Keys) {
        if ($UsedActions.ContainsKey($actionName)) {
            $usedActionsList += $actionName
        }
    }
    
    if ($usedActionsList.Count -eq 0) {
        Write-Host "`nAucune syslog action utilisee trouvee !" -ForegroundColor Yellow
    } else {
        Write-Host "`nNombre d'actions utilisees : $($usedActionsList.Count)" -ForegroundColor Green
        Write-Host "Ces actions sont referencees par au moins une policy :`n" -ForegroundColor Green
        
        foreach ($actionName in ($usedActionsList | Sort-Object)) {
            Write-Host "  ├─ " -NoNewline -ForegroundColor Green
            Write-Host "$actionName" -ForegroundColor Green
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "Utilisee par les policies :" -ForegroundColor DarkGray
            
            foreach ($policyName in $UsedActions[$actionName]) {
                Write-Host "  │    • " -NoNewline -ForegroundColor DarkGray
                Write-Host "$policyName" -ForegroundColor Cyan
                Write-Host "  │      " -NoNewline -ForegroundColor DarkGray
                Write-Host "$($Policies[$policyName]['Line'])" -ForegroundColor White
            }
            Write-Host "  │" -ForegroundColor DarkGray
        }
        Write-Host "  └─────────────────────────────────────────────────────────────" -ForegroundColor Green
    }
}

function Show-UsedPolicies {
    param($Policies, $BoundPolicies)
    
    Write-Host "`n==================================================================" -ForegroundColor Green
    Write-Host " SYSLOG POLICIES BINDEES" -ForegroundColor Green -BackgroundColor Black
    Write-Host "==================================================================" -ForegroundColor Green
    
    $usedPoliciesList = @()
    
    foreach ($policyName in $Policies.Keys) {
        if ($BoundPolicies.ContainsKey($policyName)) {
            $usedPoliciesList += $policyName
        }
    }
    
    if ($usedPoliciesList.Count -eq 0) {
        Write-Host "`nAucune syslog policy bindee trouvee !" -ForegroundColor Yellow
    } else {
        Write-Host "`nNombre de policies bindees : $($usedPoliciesList.Count)" -ForegroundColor Green
        Write-Host "Ces policies sont bindees en global :`n" -ForegroundColor Green
        
        foreach ($policyName in ($usedPoliciesList | Sort-Object)) {
            $policy = $Policies[$policyName]
            Write-Host "  ├─ " -NoNewline -ForegroundColor Green
            Write-Host "$policyName" -ForegroundColor Green
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "Action utilisee : " -NoNewline -ForegroundColor DarkGray
            Write-Host "$($policy['Action'])" -ForegroundColor Cyan
            Write-Host "  │  " -NoNewline -ForegroundColor DarkGray
            Write-Host "Bindee sur :" -ForegroundColor DarkGray
            
            foreach ($binding in $BoundPolicies[$policyName]) {
                Write-Host "  │    • " -NoNewline -ForegroundColor DarkGray
                Write-Host "$($binding['Description'])" -ForegroundColor Cyan
                Write-Host "  │      " -NoNewline -ForegroundColor DarkGray
                Write-Host "$($binding['Line'])" -ForegroundColor White
            }
            Write-Host "  │" -ForegroundColor DarkGray
        }
        Write-Host "  └─────────────────────────────────────────────────────────────" -ForegroundColor Green
    }
}

# ============================================================================
# EXECUTION PRINCIPALE
# ============================================================================

Clear-Host

Write-Host "`n" -NoNewline
Write-Host "╔" -NoNewline -ForegroundColor Cyan
Write-Host "═══════════════════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host "║" -NoNewline -ForegroundColor Cyan
Write-Host "                                                                               " -NoNewline
Write-Host "║" -ForegroundColor Cyan
Write-Host "║" -NoNewline -ForegroundColor Cyan
Write-Host "        ANALYSE DES AUDIT SYSLOG ACTIONS ET POLICIES NETSCALER                 " -NoNewline -ForegroundColor Yellow
Write-Host "║" -ForegroundColor Cyan
Write-Host "║" -NoNewline -ForegroundColor Cyan
Write-Host "                                                                               " -NoNewline
Write-Host "║" -ForegroundColor Cyan
Write-Host "╚" -NoNewline -ForegroundColor Cyan
Write-Host "═══════════════════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan

# Charger la configuration
$lines = Load-NSConf -FilePath $NS_CONF_PATH

# Extraire les objets
Write-Host "`n[ETAPE 1] Extraction des syslog actions..." -ForegroundColor Cyan
$actions = Get-SyslogActions -Lines $lines

Write-Host "`n[ETAPE 2] Extraction des syslog policies..." -ForegroundColor Cyan
$policies = Get-SyslogPolicies -Lines $lines

Write-Host "`n[ETAPE 3] Extraction des bindings de policies..." -ForegroundColor Cyan
$bindings = Get-SyslogPolicyBindings -Lines $lines

# Analyser l'utilisation
Write-Host "`n[ETAPE 4] Analyse des policies bindees..." -ForegroundColor Cyan
$boundPolicies = Get-BoundPolicies -Bindings $bindings

Write-Host "`n[ETAPE 5] Analyse de l'utilisation des actions..." -ForegroundColor Cyan
$usedActions = Get-UsedActions -Policies $policies -BoundPolicies $boundPolicies

# Afficher les résultats
Write-Host "`n[ETAPE 6] Generation du rapport..." -ForegroundColor Cyan

# Calculer les statistiques
$unusedActionsCount = ($actions.Keys | Where-Object { -not $usedActions.ContainsKey($_) }).Count
$usedActionsCount = ($actions.Keys | Where-Object { $usedActions.ContainsKey($_) }).Count
$unusedPoliciesCount = ($policies.Keys | Where-Object { -not $boundPolicies.ContainsKey($_) }).Count
$usedPoliciesCount = ($policies.Keys | Where-Object { $boundPolicies.ContainsKey($_) }).Count

# Afficher le RESUME en premier
Write-Host "`n==================================================================" -ForegroundColor Cyan
Write-Host " RESUME DE L'ANALYSE" -ForegroundColor Yellow -BackgroundColor Black
Write-Host "==================================================================" -ForegroundColor Cyan

Write-Host "`nSYSLOG ACTIONS :" -ForegroundColor White
Write-Host "  • Total : $($actions.Count)" -ForegroundColor Cyan
Write-Host "  • Utilisees : $usedActionsCount" -ForegroundColor Green
Write-Host "  • Non utilisees : $unusedActionsCount" -ForegroundColor Red

Write-Host "`nSYSLOG POLICIES :" -ForegroundColor White
Write-Host "  • Total : $($policies.Count)" -ForegroundColor Cyan
Write-Host "  • Bindees : $usedPoliciesCount" -ForegroundColor Green
Write-Host "  • Non bindees : $unusedPoliciesCount" -ForegroundColor Red

Write-Host "`n==================================================================" -ForegroundColor Cyan

# Generer les commandes de suppression si necessaire
$unusedActionsList = $actions.Keys | Where-Object { -not $usedActions.ContainsKey($_) } | Sort-Object
$unusedPoliciesList = $policies.Keys | Where-Object { -not $boundPolicies.ContainsKey($_) } | Sort-Object

if (($unusedActionsList.Count -gt 0) -or ($unusedPoliciesList.Count -gt 0)) {
    Write-Host "`n==================================================================" -ForegroundColor Yellow
    Write-Host " COMMANDES DE SUPPRESSION (copier-coller)" -ForegroundColor Yellow -BackgroundColor Black
    Write-Host "==================================================================" -ForegroundColor Yellow
    Write-Host ""
    
    if ($unusedPoliciesList.Count -gt 0) {
        Write-Host "# Suppression des policies non bindees" -ForegroundColor Gray
        foreach ($policyName in $unusedPoliciesList) {
            Write-Host "rm audit syslogPolicy $policyName" -ForegroundColor White
        }
        Write-Host ""
    }
    
    if ($unusedActionsList.Count -gt 0) {
        Write-Host "# Suppression des actions non utilisees" -ForegroundColor Gray
        foreach ($actionName in $unusedActionsList) {
            Write-Host "rm audit syslogAction $actionName" -ForegroundColor White
        }
    }
    
    Write-Host "`n==================================================================" -ForegroundColor Yellow
}

# Afficher d'abord les objets NON UTILISÉS en ROUGE
Show-UnusedActions -Actions $actions -UsedActions $usedActions -Policies $policies -BoundPolicies $boundPolicies
Show-UnusedPolicies -Policies $policies -BoundPolicies $boundPolicies

# Afficher ensuite les objets UTILISÉS en VERT
Show-UsedActions -Actions $actions -UsedActions $usedActions -Policies $policies
Show-UsedPolicies -Policies $policies -BoundPolicies $boundPolicies

Write-Host "`nAnalyse terminee avec succes !" -ForegroundColor Green
Write-Host ""


</pre>