freeradius dies. a wierd occurance
hi, we've got a couple of FR 2.0.1 boxes helping us to run the show. the daemon just dies occasionally. no really special things in the log...but I do see some of this before it does nothing else. SNMP is not on ;-) Thu Jan 24 22:41:00 2008 : Error: rlm_eap: Failed to remember handler! Thu Jan 24 22:41:00 2008 : Error: TLS Alert write:fatal:bad record mac Thu Jan 24 22:41:00 2008 : Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Thu Jan 24 22:41:00 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Thu Jan 24 22:41:52 2008 : Error: rlm_eap: Failed to remember handler! Thu Jan 24 22:41:52 2008 : Error: rlm_eap: No EAP session matching the State variable. Thu Jan 24 22:41:52 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu Jan 24 22:42:22 2008 : Error: rlm_eap: Failed to remember handler! should I be especially worried about any of these messages? could/should they occur in daily usage - we have plenty of unconfigured EAP clients etc trying all kinds of craziness. properly configured clients are quite happy when the daemon is working. the system call line concerns me...as does failure to remember a handler. very very slow client taking longer than the EAP timer? alan
A.L.M.Buxey@lboro.ac.uk wrote:
Thu Jan 24 22:41:00 2008 : Error: rlm_eap: Failed to remember handler!
Hmm... that means it's out of memory, or that there are multiple EAP sessions that match the same NAS IP/EAP Id combination. Weird.
should I be especially worried about any of these messages? could/should they occur in daily usage - we have plenty of unconfigured EAP clients etc trying all kinds of craziness. properly configured clients are quite happy when the daemon is working.
the system call line concerns me...as does failure to remember a handler. very very slow client taking longer than the EAP timer?
No. If that happened, a different message would show up. Alan DeKok.
On Fri, Jan 25, 2008 at 02:35:17PM +0100, Alan DeKok wrote:
A.L.M.Buxey@lboro.ac.uk wrote:
Thu Jan 24 22:41:00 2008 : Error: rlm_eap: Failed to remember handler!
Hmm... that means it's out of memory, or that there are multiple EAP sessions that match the same NAS IP/EAP Id combination. Weird.
Speaking of out of memory, I had 2.0.0pre2 exit for lack of memory on me a few nights ago, after a few months of runtime doing PPP authentication with users stored in MySQL. We don't have any fancy stuff. I didn't mention it because it's probably already fixed in the released version of 2.0. I don't know how large the process had grown. I hadn't logged into that box in a month. That box has 2GB RAM, but RADIUS isn't the only thing running there. But to run out of memory would have taken some doing. Mem: 302M Active, 1270M Inact, 222M Wired, 61M Cache, 112M Buf, 146M Free Swap: 4096M Total, 696K Used, 4095M Free On FreeBSD, the Inact memory pool is available to any process which wants it. Until something wants memory, FreeBSD keeps it around as a sort of cache. Currently there is about 1416MB of RAM available. Just in case you might think it is interesting, here are current snapshots of memory usage; still running 2.0.0pre2. The box that ran out of memory: USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 7992 0.0 0.7 15820 14148 ?? SsJ Wed06PM 0:51.58 /usr/local/sbin/radiusd That's been running since 6PM Wednesday January 23 when I manually rotated the log files. The secondary box: USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 77985 0.0 4.2 25824 21608 ?? Ss 14Jan08 4:09.63 /usr/local/sbin/radiusd Mon Jan 21 00:05:06 2008 : Auth: Login incorrect: [sonya@blah.net] (from client router port 1008) Mon Jan 21 00:05:06 2008 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [whitencl@sample.net] (from client router port 862) Mon Jan 21 00:05:06 2008 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [whitencl@sample.net] (from client router port 862) Mon Jan 21 00:05:07 2008 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [whitencl@sample.net] (from client router port 862) Mon Jan 21 00:05:08 2008 : Auth: Login incorrect: [bmcquire@blah.net] (from client router port 1653) Mon Jan 21 00:05:08 2008 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [peggydon@sample.net] (from client router port 816) Mon Jan 21 00:05:08 2008 : Error: rlm_radutmp: Logout for NAS router port 268566701, but no Login record Mon Jan 21 00:05:08 2008 : Auth: Login incorrect: [sample.net@blah.net] (from client router port 858) Mon Jan 21 00:05:08 2008 : Auth: Login incorrect: [bmcquire@blah.net] (from client router port 1653) Mon Jan 21 00:05:08 2008 : Auth: Login incorrect: [bmcquire@blah.net] (from client router port 1653) Mon Jan 21 00:05:08 2008 : Error: rlm_sql: Failed to create the pair: out of memory Mon Jan 21 00:05:08 2008 : Error: rlm_sql (sql): Error getting data from database Mon Jan 21 00:05:08 2008 : Error: rlm_sql (sql): Error retrieving reply pairs for group dsl Mon Jan 21 00:05:08 2008 : Error: rlm_sql (sql): Error processing groups; rejecting user Mon Jan 21 00:05:08 2008 : Auth: Login OK: [Leotus@blah.net] (from client router port 929) Mon Jan 21 00:05:09 2008 : Auth: Login incorrect: [sonya@blah.net] (from client router port 1008) Mon Jan 21 00:05:09 2008 : Auth: Login incorrect: [blither.net@blah.net] (from client router port 528) Mon Jan 21 00:05:09 2008 : Error: rlm_sql: Failed to create the pair: out of memory Mon Jan 21 00:05:09 2008 : Error: rlm_sql (sql): Error getting data from database Mon Jan 21 00:05:09 2008 : Error: rlm_sql (sql): SQL query error; rejecting user Mon Jan 21 00:05:09 2008 : Error: rlm_radutmp: Logout entry for NAS router port 271777916 has wrong ID Mon Jan 21 00:05:09 2008 : Error: no memory Mon Jan 21 03:07:59 2008 : Info: Starting - reading configuration files ... Mon Jan 21 03:07:59 2008 : Info: rlm_exec: wait=yes but no output defined. Did you mean output=none? Mon Jan 21 03:08:00 2008 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Jan 21 03:08:00 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Jan 21 03:08:00 2008 : Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:/radius Mon Jan 21 03:08:00 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 21 03:08:00 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 21 03:08:00 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 21 03:08:00 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 21 03:08:00 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 -- Scott Lambert KC5MLE Unix SysAdmin lambert@lambertfam.org
Scott Lambert wrote:
Speaking of out of memory, I had 2.0.0pre2 exit for lack of memory
Don't run -pre2. It has known memory leaks.
on me a few nights ago, after a few months of runtime doing PPP authentication with users stored in MySQL. We don't have any fancy stuff. I didn't mention it because it's probably already fixed in the released version of 2.0.
Yup. Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Scott Lambert