Hi All, last night we upgraded our NetScaler appliances from 13.0 to 13.1, everything went well except we are seeing the logs flooded with "*default EVENT MONITORDOWN 20916 0 : Monitor DBSMonServiceBinding_login.microsoftonline.com:443_(tcp-default)(vpndbssvc_1339998057) - State DOWN*" The only reference I can find to this is the TCP_default monitor being bound to a servers called vpndbssvc_1339998057 which is non-addressable 0.0.0.0. However I cannot find the service under traffic management, has anyone else come across this or know of a way to dig deeper into the cause?

I have never seen that on a monitor before. You should be able to issue a "show service vpndbssvc_1339998057" from the command line and see where it is.

Once you find what the service monitor is "monitoring", it could be related to CTX249963

It is probably related to any SAML connection.

Didn't think SAML. I wonder if it is associated with a Entra-ID function given the service it was looking for.

Well, some part of the config points to Azure, whether it is Entra or something else that needs the connection. I’ve been getting the same messages at my customer. Just started to ignore given we have absolutely no control over them.

Yeah, I'd bet it's something to do with some SAML/Oauth/*.modernauth endpoint, hence the rolling IP behind a FQDN being monitored.

Yeah we do have Azure MFA setup so probably to do with that. As @Jan Tytgat mentioned we are not seeing any issues with it, just filling the logs with noise.

That is strange.

No, because it isn’t something you create yourself