On Thu, Apr 21, 2016 at 01:02:06PM +0000, Christian Strauf wrote:
we're trying to use an ELK stack (Elasticsearch, Logstash & Kibana) to monitor the performance of our FreeRADIUS 3.0.11 servers which rely on a number of external servers (database, directory etc.).
Nice. I assume you've seen https://github.com/FreeRADIUS/freeradius-server/tree/v3.1.x/doc/schemas/logs... which might be useful.
A prerequisite for this is that we can actually correlate Access-Requests and replies by the RADIUS server.
The State attribute should tie any challenges with the subsequent request, which might be helpful.
Do you guys happen to know a suitable way of creating such a FreeRADIUS-Correlationa-Id that's unique for an Access-Request-...-Access-Accept exchange? I'm not sure whether the NAS will also include the attribute in all its later request packets. Do you happen to know if this is the case?
Include the Calling-Station-Id and User-Name as well? Then perhaps hash them to get a (most likely unique) hex string. (See e.g. acct_unique policy.) I would have thought you could generate a new Correlation attribute on first request, log it with the request, and then cache it with rlm_cache. Then pull it out each time you are about to log a request or reply and put it on the log. Then you should have a stable ID across all entries in your elasticsearch db.
The approach with a correlation ID has one more disadvantage: according to RFC 2865, Access-Reject messages mustn't include such attributes. So this leaves us with the problem how to correlate rejects.
You might be better to keep track of the request time in FreeRADIUS and then just log it with each log entry. rlm_cache probably needed as well - but examples of arithmetic are in sites-enabled/default preacct (FreeRADIUS-Acct-Session-Start-Time). Doing both timing in FR as well as a Correlation attribute is probably the best option. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>