Hi Frank, Thanks for your reply. My syslog server is running in my local machine. And im running the freeradius server also in the same machine. What configuration should be done in the freeradius server-1.1.1 to send the logs to the syslog server say: X.X.X.X Awaiting for your reply. Thanks Sumithra On 5/10/06, Frank Cusack <fcusack@fcusack.com> wrote:

On May 10, 2006 1:02:46 PM +0530 sumi thra <sumi.techno@gmail.com> wrote:

...

Hi All,

How to send the freeradius server logs to remote syslog server??

Is it a compile time option? or we need to specify in config script to build with syslog option. or starting the server with radiusd -l syslog is enough ?

Going to syslog only goes to the local syslog. You also have to configure your syslogd to send to the remote server. That's not part of freeradius, look at syslog.conf(5).

-frank - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

Hi frank, I got it. But my concern is, im not seeing those logs in the local syslog server itself. I think log_dir = /var/log/radius.log option in readiusd.conf over writes the -l syslog option. What config change is needed in freeradius server side so that the logs goes to the syslog server( whether its local or remote ) ? Note : All the logs goes to /var/log/radius.log now. Thanks Sumi On 5/10/06, Frank Cusack <fcusack@fcusack.com> wrote:

As I already said, freeradius can't do that. Refer to the documentation for your local syslog server to see how to send the logs remotely.

-frank

On May 10, 2006 1:25:35 PM +0530 sumi <sumi.rs@gmail.com> wrote:

...

Hi Frank,

Thanks for your reply.

My syslog server is running in my local machine. And im running the freeradius server also in the same machine.

What configuration should be done in the freeradius server-1.1.1 to send the logs to the syslog server say: X.X.X.X

Awaiting for your reply.

Thanks Sumithra

On 5/10/06, Frank Cusack <fcusack@fcusack.com> wrote:

...

On May 10, 2006 1:02:46 PM +0530 sumi thra <sumi.techno@gmail.com>

wrote:

...

...

Hi All,

How to send the freeradius server logs to remote syslog server??

Is it a compile time option? or we need to specify in config script to build with syslog option. or starting the server with radiusd -l syslog is enough ?

Going to syslog only goes to the local syslog. You also have to configure your syslogd to send to the remote server. That's not part of freeradius, look at syslog.conf(5).

-frank

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

Hey Alan, Thank you so much for your kind reply. But, im not able to figure-out the correct configuration. I am using the default radiusd.conf file. Please let me know which config item needs to be changed for the same. Awaiting for your reply. Thanks Sumi On 5/10/06, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

But my concern is, im not seeing those logs in the local syslog server itself.

because you havent configured it to.

...

I think log_dir = /var/log/radius.log option in readiusd.conf over writes the -l syslog option.

the '-l' option is to define a log file location. why do you believe it to be otherwise?

...

What config change is needed in freeradius server side so that the logs goes to the syslog server( whether its local or remote ) ?

check the radiusd.conf file. right at the top during the first hundred lines are the parts that define HOW the server spits out its logs. you need to change the destination from 'files' to 'syslog' - theres not much else to it.

I am not seeing any config item like 'files' in the first 100 lines.

Note : All the logs goes to /var/log/radius.log now.

of course they do. you told the server to do that.

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

Hey, Thank you so much for your quick reply. there is no config line like log_destination in radiusd.conf file ( http://wiki.freeradius.org/index.php/Radiusd.conf ) Thanks Sumi On 5/11/06, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

But, im not able to figure-out the correct configuration.

I am using the default radiusd.conf file.

that wont work. you must configure the radiusd.conf file

...

Please let me know which config item needs to be changed for the same.

isnt it obvious? the default config file is well documented and laid out. lets look at a few basic parts:

# # Destination for log messages. This can be one of: # # files - log to ${log_file}, as defined above. # syslog - to syslog (see also the log{} section, below) # stdout - standard output # stderr - standard error. # # The command-line option "-X" over-rides this option, and forces # logging to go to stdout. # log_destination = files

so, change that line to

log_destination = syslog

now, lets look at the other part mentioned...the log{} stanza: it says that the option, of 'daemon' is usual and is OS dependent. as there is little traffic from people regarding issues and extra requirements you may leave this as is.

wheres the difficulty?

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

Hi, I am using the latest version 1.1.1. Please find the config file that i am using.. ## ## radiusd.conf -- FreeRADIUS server configuration file. ## ## http://www.freeradius.org/ ## $Id: radiusd.conf.in,v 1.188.2.4 2005/06/11 22:20:40 nbk Exp $ ## # The location of other config files and # logfiles are declared in this file # # Also general configuration for modules can be done # in this file, it is exported through the API to # modules that ask for it. # # The configuration variables defined here are of the form ${foo} # They are local to this file, and do not change from request to # request. # # The per-request variables are of the form %{Attribute-Name}, and # are taken from the values of the attribute in the incoming # request. See 'doc/variables.txt' for more information. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} # # The logging messages for the server are appended to the # tail of this file. # #log_file = ${logdir}/radius.log #log_file = syslog" log_destination = syslog # # libdir: Where to find the rlm_* modules. # # This should be automatically set at configuration time. # # If the server builds and installs, but fails at execution time # with an 'undefined symbol' error, then you can use the libdir # directive to work around the problem. # # The cause is usually that a library has been installed on your # system in a place where the dynamic linker CANNOT find it. When # executing as root (or another user), your personal environment MAY # be set up to allow the dynamic linker to find the library. When # executing as a daemon, FreeRADIUS MAY NOT have the same # personalized configuration. # # To work around the problem, find out which library contains that symbol, # and add the directory containing that library to the end of 'libdir', # with a colon separating the directory names. NO spaces are allowed. # # e.g. libdir = /usr/local/lib:/opt/package/lib # # You can also try setting the LD_LIBRARY_PATH environment variable # in a script which starts the server. # # If that does not work, then you can re-configure and re-build the # server to NOT use shared libraries, via: # # ./configure --disable-shared # make # make install # libdir = ${exec_prefix}/lib # pidfile: Where to place the PID of the RADIUS server. # # The server may be signalled while it's running by using this # file. # # This file is written when ONLY running in daemon mode. # # e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid` # pidfile = /var/run/radiusd/radiusd.pid # user/group: The name (or #number) of the user/group to run radiusd as. # # If these are commented out, the server will run as the user/group # that started it. In order to change to a different user/group, you # MUST be root ( or have root privleges ) to start the server. # # We STRONGLY recommend that you run the server with as few permissions # as possible. That is, if you're not using shadow passwords, the # user and group items below should be set to 'nobody'. # # On SCO (ODT 3) use "user = nouser" and "group = nogroup". # # NOTE that some kernels refuse to setgid(group) when the value of # (unsigned)group is above 60000; don't use group nobody on these systems! # # On systems with shadow passwords, you might have to set 'group = shadow' # for the server to be able to read the shadow password file. If you can # authenticate users while in debug mode, but not in daemon mode, it may be # that the debugging mode server is running as a user that can read the # shadow info, and the user listed below can not. # #user = nobody #group = nobody # max_request_time: The maximum time (in seconds) to handle a request. # # Requests which take more time than this to process may be killed, and # a REJECT message is returned. # # WARNING: If you notice that requests take a long time to be handled, # then this MAY INDICATE a bug in the server, in one of the modules # used to handle a request, OR in your local configuration. # # This problem is most often seen when using an SQL database. If it takes # more than a second or two to receive an answer from the SQL database, # then it probably means that you haven't indexed the database. See your # SQL server documentation for more information. # # Useful range of values: 5 to 120 # max_request_time = 30 # delete_blocked_requests: If the request takes MORE THAN 'max_request_time' # to be handled, then maybe the server should delete it. # # If you're running in threaded, or thread pool mode, this setting # should probably be 'no'. Setting it to 'yes' when using a threaded # server MAY cause the server to crash! # delete_blocked_requests = no # cleanup_delay: The time to wait (in seconds) before cleaning up # a reply which was sent to the NAS. # # The RADIUS request is normally cached internally for a short period # of time, after the reply is sent to the NAS. The reply packet may be # lost in the network, and the NAS will not see it. The NAS will then # re-send the request, and the server will respond quickly with the # cached reply. # # If this value is set too low, then duplicate requests from the NAS # MAY NOT be detected, and will instead be handled as seperate requests. # # If this value is set too high, then the server will cache too many # requests, and some new requests may get blocked. (See 'max_requests'.) # # Useful range of values: 2 to 10 # cleanup_delay = 5 # max_requests: The maximum number of requests which the server keeps # track of. This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. # # If this number is too low, then when the server becomes busy, # it will not respond to any new requests, until the 'cleanup_delay' # time has passed, and it has removed the old requests. # # If this number is set too high, then the server will use a bit more # memory for no real benefit. # # If you aren't sure what it should be set to, it's better to set it # too high than too low. Setting it to 1000 per client is probably # the highest it should be. # # Useful range of values: 256 to infinity # max_requests = 1024 # bind_address: Make the server listen on a particular IP address, and # send replies out from that address. This directive is most useful # for machines with multiple IP addresses on one interface. # # It can either contain "*", or an IP address, or a fully qualified # Internet domain name. The default is "*" # # As of 1.0, you can also use the "listen" directive. See below for # more information. # bind_address = * # port: Allows you to bind FreeRADIUS to a specific port. # # The default port that most NAS boxes use is 1645, which is historical. # RFC 2138 defines 1812 to be the new port. Many new servers and # NAS boxes use 1812, which can create interoperability problems. # # The port is defined here to be 0 so that the server will pick up # the machine's local configuration for the radius port, as defined # in /etc/services. # # If you want to use the default RADIUS port as defined on your server, # (usually through 'grep radius /etc/services') set this to 0 (zero). # # A port given on the command-line via '-p' over-rides this one. # # As of 1.0, you can also use the "listen" directive. See below for # more information. # port = 0 # # By default, the server uses "bind_address" to listen to all IP's # on a machine, or just one IP. The "port" configuration is used # to select the authentication port used when listening on those # addresses. # # If you want the server to listen on additional addresses, you can # use the "listen" section. A sample section (commented out) is included # below. This "listen" section duplicates the functionality of the # "bind_address" and "port" configuration entries, but it only listens # for authentication packets. # # If you comment out the "bind_address" and "port" configuration entries, # then it becomes possible to make the server accept only accounting, # or authentication packets. Previously, it always listened for both # types of packets, and it was impossible to make it listen for only # one type of packet. # #listen { # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) # ipaddr = * # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" # port = 0 # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # # type = auth #} # hostname_lookups: Log the names of clients or just their IP addresses # e.g., www.freeradius.org (on) or 206.47.27.232 (off). # # The default is 'off' because it would be overall better for the net # if people had to knowingly turn this feature on, since enabling it # means that each client request will result in AT LEAST one lookup # request to the nameserver. Enabling hostname_lookups will also # mean that your server may stop randomly for 30 seconds from time # to time, if the DNS requests take too long. # # Turning hostname lookups off also means that the server won't block # for 30 seconds, if it sees an IP address which has no name associated # with it. # # allowed values: {no, yes} # hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # # allowed values: {no, yes} # allow_core_dumps = no # Regular expressions # # These items are set at configure time. If they're set to "yes", # then setting them to "no" turns off regular expression support. # # If they're set to "no" at configure time, then setting them to "yes" # WILL NOT WORK. It will give you an error. # regular_expressions = yes extended_expressions = yes # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes ................ ..... .... Thanks Sumi On 5/11/06, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

there is no config line like log_destination in radiusd.conf file ( http://wiki.freeradius.org/index.php/Radiusd.conf )

that is the default config from an old version. what version are you running. what does YOUR config look like?

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

Hi, Thank you so much for your great & kind reply. Its working fine now. Thanks once again. :-) Best Regards Sumi On 5/11/06, Enrik Berkhan <enrik#freeradius@planb.de> wrote:

sumi wrote:

...

logdir = ${localstatedir}/log/radius

logdir = syslog

Enrik -- Enrik Berkhan plan b. GmbH Rüppurrer Straße 4 +49-721-388582 (voice) 76137 Karlsruhe +49-721-388581 (fax) Germany - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

-- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"