ns.log：
Dec 31 16:13:57 <local0.warn> 172.31.248.107  12/31/2022:08:13:57 GMT PHQCXADC01 0-PPE-0 : default SSLVPN Message 263167 0 :  "Created nFactor session for user Anonymous" 
Dec 31 16:13:57 <local0.info> 172.31.248.107  12/31/2022:08:13:57 GMT PHQCXADC01 0-PPE-0 : default SSLVPN Message 263174 0 :  "AAAD API: aaad_authenticate_req: sending login req to aaad for <Anonymous>, factor <OTPManOAtuh__root>, auth type 4161, trans id 120288" 
Dec 31 16:13:57 <local0.info> 172.31.248.107  12/31/2022:08:13:57 GMT PHQCXADC01 0-PPE-0 : default AAATM Message 263177 0 :  "AAAD RESP: received resp, user: <Anonymous>, factor: <OTPManOAtuh__root>, trans id 120288, pcb trans id 120288, q_flags 1879080964 aaad-resp 2 aaad-flags 2000" 
Dec 31 16:18:57 <local0.info> 172.31.248.107  12/31/2022:08:18:57 GMT PHQCXADC01 0-PPE-0 : default AAATM LOGOUT 263222 0 :  User Anonymous - Client_ip 42.73.133.4 - Nat_ip "Mapped Ip" - Vserver 172.31.248.102:443 - Start_time "12/31/2022:08:13:57 GMT" - End_time "12/31/2022:08:18:57 GMT" - Duration 00:05:00  - Http_resources_accessed 0 - Total_TCP_connections 0 - Total_policies_allowed 0 - Total_policies_denied 0 - Total_bytes_send 0 - Total_bytes_recv 0 - Total_compressedbytes_send 0 - Total_compressedbytes_recv 0 - Compression_ratio_send 0.00% - Compression_ratio_recv 0.00% - LogoutMethod "TimedOut" - Group(s) "N/A" 

---

Instructions

The user accessed Citrix Gateway login page, but did not enter the credentials. After 5 minutes, the page timeout time was reached, then such "default AAATM LOGOUT 263222 0 :  User Anonymous - Client_ip 42.73.133.4 - Nat_ip "Mapped Ip"..." log was generated at this time. It can also be seen from the logs that the reason for logout is "LogoutMethod "TimedOut"".