How can I output Cisco-AVPair Attributes in linelog?

5 Oct 2009

      Greetings,

I'm playing with using the linelog module to syslog accounting records.
The basics are pretty straightforward to configure, and I have them
working. What I can't figure out is how to include the ssid in the
linelog output. 'radiusd -X' kindly dumps the contents of the received
accounting requests:

rad_recv: Accounting-Request packet from host 10.2.2.2 port 1646, id=62,
length=234
	Acct-Session-Id = "0000004D"
	Called-Station-Id = "001b.d517.4080"
	Calling-Station-Id = "0026.4aea.ba42"
	Cisco-AVPair = "ssid=TEST"
	Cisco-AVPair = "vlan-id=228"
	Cisco-AVPair = "nas-location=Office"
	WISPr-Location-Name = "Office"
	User-Name = "testuser"
	Cisco-AVPair = "connect-progress=Call Up"
	Acct-Authentic = RADIUS
	Acct-Status-Type = Start
	NAS-Port-Type = Wireless-802.11
	Cisco-NAS-Port = "301"
	NAS-Port = 301
	Service-Type = Framed-User
	NAS-IP-Address = 10.2.2.2
	Acct-Delay-Time = 0

The SSID is in a Cisco-AVPair. I can include them all via

Start = "Connect: User: %{User-Name} ( client: %{Calling-Station-Id}
location: %{WISPr-Location-Name}) %{Cisco-AVPair[*]}"

or the first one by using %{Cisco-AVPair[1]}. But I have no guarantee
that the ssid will be the first AV pair.

I've tried using unlang constructs to pull the data out, but can't
figure out the right syntax. I'm trying something like the config below,
just to see if the 'if/else' clauses even fire and they don't. No matter
what I put in for the regexp, SSID never gets redefined to TRUE or
FALSE. It always outputs as 'Junk'. I'm sure this is doable, I just
don't know the exact syntax. Any ideas? Thanks in advance.
...
From linelog configuration:
Accounting-Request {
        SSID="Junk"
        Pairs = "%{Cisco-AVPair[0]}"
        if ( Pairs =~ /.*/ ) {
            SSID="TRUE"
        }
        else {
            SSID = "FALSE"
        }
        Start = "Connect: User: %{User-Name} ( client:
%{Calling-Station-Id} location: %{WISPr-Location-Name}) SSID:${SSID}
${Pairs}"

-- 
-----------------------------------------------------------------
| David Mitchell (mitchell@ucar.edu)       Network Engineer IV  |
| Tel: (303) 497-1845                      National Center for  |
| FAX: (303) 497-1818                      Atmospheric Research |
-----------------------------------------------------------------