Spent some time on the phone with Netscaler support over the past few weeks, and made a note of two commands they used that I found useful.
The first will tell you, in real-time, what policies are hitting when a user logs in via Netscaler:
nsconmsg -g pol_hits -d current
The next will show you traffic, in real time, and let you filter it on IP:
nstcpdump.sh host <IP Address>
Not sure if anyone else will find these useful, but I’m sure I’ll be referring back to this post to use them in the future.