6 Feb
2019
6 Feb
'19
11:44 a.m.
We're using graylog at work to interpret syslog messages. You can create alerts if for example more than x login attempts failed within a certain time frame and then get notified about it. You just need to define a grok pattern for it. You could also use process monitoring through SNMP to get an alert when something happens to the radius process itself. Regards, Niels On Thu, Feb 7, 2019, 00:35 Jorge Pereira <jpereiran@gmail.com wrote: > On Wed, Feb 6, 2019 at 12:45 PM R3DNano <r3dnano@gmail.com> wrote: > > > > I'm trying to manage the global freeradius status from a remote location. > > The files under /var/log/radius/radacct are pretty detailed and have a > > lot of information about what is going on with the freeradius server. > > However, searching the old mailing list archives, I see there's a > > particular thread of someone asking how to send the radacct logs to a > > remote syslog being not a recommended practice. > > > > I did something similar using the syslog-ng with pattern-db > > https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.19/administration-guide/72#TOPIC-1094740 > > > What's a practical way of having this information for further analysis > > outside of the freeradius server? Send it to an SQL database somehow > > perhaps? > > > > Also, about the logs sent to syslog (for further forwarding to a > > remote syslog server) - is there a way to customize what's being sent > > on those messages? > > > > Thanks. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html