NetScaler authentication failures? aaad.debug

If you ever get authentication failures when trying to log on to NetScaler Gateway with credentials you know are correct then start logging the authentication attempts on NetScaler using aaad.debug to find out what is going wrong.

NetScaler Logon Process and Failure Reasonshttps://jgspiers.com/digging-in-to-citrix-logon-process/

To enable logging, using NetScaler CLI -> type shell -> type cd /tmp -> type cat aaad.debug and press enter. (Authentication, Authorization and Auditing Deamon).

1

2

Any authentication attempts will now be displayed in the output shown above.

You can also record the output of AAA to a log file using the below command:

cat aaad.debug | tee /tmp/aaa.log


8 Comments

  • Anonymous

    October 4, 2018

    Question…New to Netscaler troubleshooting.
    With regard to the aaad.debug file and watching it for errors instead of cat’ing the file could you tail -f it to watch it?

    Rob

    Reply
    • George Spiers

      October 8, 2018

      No because aaad.debug is not a flat file, there is nothing being logged.

      Reply
  • Anonymous

    February 17, 2020

    Is it possible to view this file without having “nsroot” access?

    Reply
    • George Spiers

      May 10, 2020

      It is yes.

      Reply
  • Marshel Gails

    December 2, 2020

    Is there any ways to troubleshoot shoot it using gui

    Reply
    • Walter Scott

      January 8, 2021

      Yes but it doesn’t always work with different browsers and versions of ADC. Stick with AAAD.debug because it never fails

      Reply
  • Dwayne

    November 15, 2021

    if need any account can have its RBAC edited via regex to allow shell to only do this.

    ie create an allow command policy with “shell cat /tmp/aaad.debug” in it. then you should be able to online it, and no other shell commands.

    Reply
  • Marco Schirrmeister

    July 28, 2022

    Maybe outdated, but still worth to add a comment.
    If someone really wants to do a “tail” for filtering, it is possible and you can do the following.

    First shell
    cat /tmp/aaad.debug | tee /tmp/aaaddebug.log

    Second shell
    tail -F /tmp/aaaddebug.log

    Reply

Leave a Reply