The detail log is logging the reply, which doesn't contain any reasons in it, which is why you don't see anything in the log.
The errors are put in the Module-Failure-Message attribute. There are many ways of logging what you want, but one way is to copy this to the reply list before you log it. That attribute is internal only, so it won't get sent back to the client anyway.
Something like
update reply { &Module-Failure-Message := &control:Module-Failure-Message } reply_log
I tried this, my default virt server conf look like this: .... Post-Auth-Type REJECT { update reply { &Module-Failure-Message := &control:Module-Failure-Message } # log failed authentications in SQL, too. reply_log ... But the error still not appears in the detail log file. I got Access-Reject with Reply-Message: "Hello, bob" Tue Jan 8 15:46:01 2019 Packet-Type = Access-Reject Reply-Message = "Hello, bob" Timestamp = 1546958761 Any idea what's wrong? Linelog is another possibility, but as long as we could modify detail log behaviour with little work, I would not jump into a fully start linelog writing. - Tamas Alan Buxey <alan.buxey@gmail.com> ezt írta (időpont: 2019. jan. 8., K, 15:28):
don't use detail log. use linelog and define your own nice clean format and entries to be recorded.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html