Sharing in case this helps someone… you could also do something similar with your SIEM. I have a daily report sent to me as a .csv from the Netscaler console of all failed auth attempts on the gateways. It has come in handy A LOT with monitoring for potential attacks in the past year or so.

I wish my feature request ten years ago will be implemented anytime, but I don‘t think so. Auth attempts also for AAA vServers 😖

Syslog with access doesn't do this? What's needed?