Some errors not captured in Module-Failure-Message
I have a fairly standard line log stanza, which records module-failure-message: ... MODULE_MESSAGE=%{%{%{request:Module-Failure-Message}:-%{session-state:Module-Failure-Message}}:-NONE} ... There are some failures it does not record. For example (taken from radius.log): Tue Jan 3 11:16:20 2017 : Info: (125679) eap_peap: The users session was previously rejected: returning reject (again.) Mon Jan 9 10:06:53 2017 : Error: rlm_eap (EAP): No EAP session matching state 0xe679227be27f3b1e Mon Jan 9 10:03:19 2017 : ERROR: (165330) eap: ERROR: Malformed EAP Message: Malformed EAP packet. Length in packet header does not match actual length I can correlate the entries by time manually, but this makes things rather tedious; is there any way I can capture these in using linelog? Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk --- linelog rp_log { filename = syslog format = "" reference = "idp_log.%{%{reply:Packet-Type}:-format}" idp_log { Access-Accept = "radiusd-idp-log#DOMAIN=${jisc_domain}#LOCATION=${jisc_location}#SERVICE=%{%{Service-Class}:-NONE}#ORG=%{%{request:operator-name}:-%{request:Stripped-User-Domain}}#USER=%{User-Name}#CSI=%{Calling-Station-Id}#NAS=%{Called-Station-Id}#CUI=%{reply:Chargeable-User-Identity}#RESULT=OK#REPLY_MESSAGE=%{%{reply:reply-message}:-NONE}#MODULE_MESSAGE=%{%{%{request:Module-Failure-Message}:-%{session-state:Module-Failure-Message}}:-NONE}#" Access-Reject = "radiusd-idp-log#DOMAIN=${jisc_domain}#LOCATION=${jisc_location}#SERVICE=%{%{Service-Class}:-NONE}#ORG=%{%{request:operator-name}:-%{request:Stripped-User-Domain}}#USER=%{User-Name}#CSI=%{Calling-Station-Id}#NAS=%{Called-Station-Id}#CUI=%{reply:Chargeable-User-Identity}#RESULT=FAIL#REPLY_MESSAGE=%{%{reply:reply-message}:-NONE}#MODULE_MESSAGE=%{%{%{request:Module-Failure-Message}:-%{session-state:Module-Failure-Message}}:-NONE}#" } } Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On Jan 9, 2017, at 10:34 AM, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
I have a fairly standard line log stanza, which records module-failure-message:
... MODULE_MESSAGE=%{%{%{request:Module-Failure-Message}:-%{session-state:Module-Failure-Message}}:-NONE} ...
There are some failures it does not record. For example (taken from radius.log): Tue Jan 3 11:16:20 2017 : Info: (125679) eap_peap: The users session was previously rejected: returning reject (again.) Mon Jan 9 10:06:53 2017 : Error: rlm_eap (EAP): No EAP session matching state 0xe679227be27f3b1e Mon Jan 9 10:03:19 2017 : ERROR: (165330) eap: ERROR: Malformed EAP Message: Malformed EAP packet. Length in packet header does not match actual length
I can correlate the entries by time manually, but this makes things rather tedious; is there any way I can capture these in using linelog?
Submit a patch to make EAP / PEAP use Module-Failure-Message. :) Alan DeKok.
Hi,
There are some failures it does not record. For example (taken from radius.log): Tue Jan 3 11:16:20 2017 : Info: (125679) eap_peap: The users session was previously rejected: returning reject (again.)
this one is surely covered by the initial reject/fail reason......
Mon Jan 9 10:06:53 2017 : Error: rlm_eap (EAP): No EAP session matching state 0xe679227be27f3b1e Mon Jan 9 10:03:19 2017 : ERROR: (165330) eap: ERROR: Malformed EAP Message: Malformed EAP packet. Length in packet header does not match actual length
EAP module enhancements required ;-) alan
On Mon, Jan 09, 2017 at 03:34:03PM +0000, Adam Bishop wrote:
Tue Jan 3 11:16:20 2017 : Info: (125679) eap_peap: The users session was previously rejected: returning reject (again.)
RIDEBUG, not REDEBUG
Mon Jan 9 10:06:53 2017 : Error: rlm_eap (EAP): No EAP session matching state 0xe679227be27f3b1e
ERROR, not RERROR
Mon Jan 9 10:03:19 2017 : ERROR: (165330) eap: ERROR: Malformed EAP Message: Malformed EAP packet. Length in packet header does not match actual length
This should already set Module-Failure-Message?
I can correlate the entries by time manually, but this makes things rather tedious; is there any way I can capture these in using linelog?
Does this work (for these errors, at least)? https://github.com/mcnewton/freeradius-server/commit/1baf6a455609619f9b1ac7b... Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Mon, Jan 09, 2017 at 03:34:03PM +0000, Adam Bishop wrote:
Mon Jan 9 10:03:19 2017 : ERROR: (165330) eap: ERROR: Malformed EAP Message: Malformed EAP packet. Length in packet header does not match actual length
This should already set Module-Failure-Message?
It doesn't - I started looking at this one and can't figure out why nothing was logged for it. It seems to do the right thing (RERROR) but the corresponding linelog entry doesn't contain the message. If anyone has a RADIUS packet with a malformed EAP message laying around (comments indicate the eap message is too short) I'll grab a full debug and backtrace.
I can correlate the entries by time manually, but this makes things rather tedious; is there any way I can capture these in using linelog?
Does this work (for these errors, at least)?
https://github.com/mcnewton/freeradius-server/commit/1baf6a455609619f9b1ac7b...
I'll spin a build with this included and let you know, thanks. I don't envisage any problems. Regards, Adam Bishop Senior Infrastructure and Systems and Architect gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 t: +44 (0)1235 822 245 xmpp: adamb@jabber.dev.ja.net jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On 10 Jan 2017, at 12:25, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
I'll spin a build with this included and let you know, thanks. I don't envisage any problems.
Builds and runs, but my users are all being well behaved. Hopefully someone with an Android device shows up before I have to resort to wrapping an AP in tin foil... Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On Tue, Jan 10, 2017 at 04:27:02PM +0000, Adam Bishop wrote:
On 10 Jan 2017, at 12:25, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
I'll spin a build with this included and let you know, thanks. I don't envisage any problems.
Builds and runs, but my users are all being well behaved. Hopefully someone with an Android device shows up before I have to resort to wrapping an AP in tin foil...
Anything shown up? Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 11 Jan 2017, at 17:54, Matthew Newton <mcn4@leicester.ac.uk> wrote:
Anything shown up?
Nothing yet - the user that was causing most of the errors seems to have gotten bored of having no connectivity and fixed their device. I'm rolling the change out to the whole company either tomorrow or Friday, so that should generate something. Regards, Adam Bishop Senior Infrastructure and Systems Architect gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 t: +44 (0)1235 822 245 xmpp: adamb@jabber.dev.ja.net jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On 11 Jan 2017, at 19:58, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
I'm rolling the change out to the whole company either tomorrow or Friday, so that should generate something.
Looks good - got a log line log full of EAP state messages after I restarted. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On Thu, Jan 12, 2017 at 04:39:20PM +0000, Adam Bishop wrote:
On 11 Jan 2017, at 19:58, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
I'm rolling the change out to the whole company either tomorrow or Friday, so that should generate something.
Looks good - got a log line log full of EAP state messages after I restarted.
Thanks. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Adam Bishop -
Alan DeKok -
Matthew Newton