Memory

Last published : Sep 24, 2026
Following are some of the best practices to follow when encountered with Web App Firewall usage memory related issues:
nsconmsg command usage:
  • Look for global memory statistics to ascertain that there is enough memory in the system and there are no memory allocation failures by executing the following command:
    * *- nsconmsg -d memstats
  • Observe current allocated and maximum memory limits for appsecure, IP reputation, cache and compression by executing the following command:
    nsconmsg -d memstats | egrep -i APPSECURE|IPREP|CACHE|CMP
  • Check appfw, DHT, IP reputation activity counters by executing the following command:
    nsconmsg -g as -g appfwreq_ -g iprep -d current
  • Check all Web App Firewall error counters by executing the following command:
    nsconmsg -g as_ -g appfwreq_ -g iprep_ -d stats | grep err
  • Check all system error counters by executing the following command:
    nsconmsg -g err -d current
  • Inspect for CPU, APPFWREQ, AS and DHT counters by executing the following command:
    nsconmsg -g cc_cpu_use -g appfwreq -g as -g dht -d current
  • Check the configured Cache memory by executing the following command:
  • show cacheparameter
  • Check the configured memory by executing the following command:
    nsconmsg -d memstats | egrep -i CACHE
  • Identify distribution of memory in Web App Firewall components and objects:
Display AS_OBJ_ memory:
nsconmsg -K newnslog -d stats | grep AS_OBJ | egrep -v AppFW_cpu0|total | sort -k3
Display AS_COMPONENT_ memory:
nsconmsg -K newnslog -d stats | grep AS_COMPONENT | egrep -v AppFW_cpu0|total | sort –k3
Check for number of alive sessions by executing the following command:
Monitor/plot active session counts:
nsconmsg -g as_alive_sessions -d current
Monitor/plot total allocated, free, updated sessions:
  • nsconmsg -g as_tot_alloc_sessions -g as_tot_free_sessions -d current
  • nsconmsg -g as_tot_update_sessions -d current
If required, reduce session timeout to ensure that session limits are not used by executing the following command:
set appfwsettings -sessionTimeout <300>
If required, set maximum lifetime of session by executing the following command:
set appfwsettings -sessionLifetime <7200>
Related information

Checking allocated and used memory

To check the total allocated memory and used memory:
  • Use the nsconmsg –d memstats command. Observe the MEM_APPSECURE field.
  • Use the stat appfw command to obtain meory consumption information.
Web App Firewall does not automatically delete the logs after certain period of time or size.
  • All AppFw logs are archived in the */var/log/ns.log* file. The ns.log file performs the rollover task.
For more information, refer to the following link: <http://support.citrix.com/article/CTX121898>
Increasing Web App Firewall memory:
  • There is no CLI option to increase Web App Firewall memory. Web App Firewall memory is platform-specific.
  • You may use the nsapimgr option to increase memory but it is not recommended.
The max allowed memory for Web App Firewall is determined by the platform and disabling IC does not impact memory allocation.