The following are some of the best practices for NetScaler Application Firewall learning mode:

• It is recommended to enable learning mode in positive test (UAT) environment and then import the databases to the production NetScaler.
• Learn one check at a time.
• Dedicate 3-4 hours minimum of learning per application.
• Use positive automate scripts.
• Take back up copies of the learning databases as they are portable and can be loaded on any NetScaler. They can be found in /var/nslog directory with .db extension.
• Turn on blocking after loading the learn database or after finishing the learning on device.