When troubleshooting authentication issues through Citrix Gateway, the raw event output from the audit daemon can be reviewed in the .

The Authentication, Authorization, and Auditing daemon (aaad) is the core process on a Citrix ADC appliance that handles all authentication requests. For detailed troubleshooting of authentication issues, an administrator can enable the aaad.debug module. This module captures verbose, raw event output that details every step of the authentication process, including policy evaluation, server lookups (LDAP, RADIUS), and the reasons for success or failure. The output is written to the /tmp/aaad.debug file, which can be reviewed directly from the command-line interface to diagnose complex authentication problems.

A. ns.log contains general system-level events and high-level error messages, but it lacks the granular, step-by-step raw output specific to the authentication daemon.
C. A Wireshark trace captures network-level packet data. While useful for analyzing protocol exchanges (e.g., LDAP or RADIUS), it does not show the internal processing logic of the Citrix aaad daemon.
D. nsvpn.log is primarily used for logging events related to the VPN tunnel itself, such as establishment, termination, and client errors, not the underlying authentication process.

1. Citrix ADC 13.1 Product Documentation: In the section on troubleshooting authentication, the procedure explicitly directs administrators to use the aaad.debug module. It states, "At the shell prompt, type cat /tmp/aaad.debug to view the authentication debug output."

Source: Citrix Product Documentation, "Troubleshooting authentication and authorization," Section: "To get the debug log by using the command line interface."

2. Citrix Support Knowledge Center, CTX114999: This article, titled "How to Troubleshoot NetScaler Gateway Authentication using the aaad.debug Module," provides a step-by-step guide for enabling and using this specific debug module. It confirms that aaad.debug is the designated tool for capturing raw authentication events.

Source: Citrix Support Knowledge Center, Article ID: CTX114999, "How to Troubleshoot NetScaler Gateway Authentication using the aaad.debug Module."

3. Citrix ADC 13.0 Traffic Management Guide (PDF): Within the troubleshooting sections related to Authentication, Authorization, and Auditing, the guide details the use of the shell and the aaad.debug process for deep-dive analysis. It describes how to enable the debug pipe and view the output in /tmp/aaad.debug.

Source: Citrix ADC 13.0 Documentation, "Troubleshooting," Chapter on Authentication and Authorization. (Specific page numbers vary by document revision, but the content is consistently located in this section).