Hello, Could someone please recommend the way to configure a very simple logging in FreeRadius 2.1.7? As you know there are many sections like Authorize,Authenticate,Post-Auth and there is some logic in unlang so depending on if/else statements and flow regardless if authentication passed Access-Reject/Access-Accept can be send. What we need is logging all the real FINAL messages that RADIUS sends to the client Access-Rejects/Access-Accept in one line with simple detail about NAS and UserName: Something like: Time,Access-Reject(or Accept),NAS-IP-Address,User-Name I looked into "modules/detail.log" module and I have a couple of questions because apparently I have problem using it: 1. In post-auth I need to put it many places depending on unlang logic I had to add it in REJECT post-auth { .... person can get rejected Post-Auth-Type REJECT { ---> reply_log attr_filter.access_reject } .. } Is there a way to put logging in one final place so it will be invoked regardless of UNLANG flow? 2. In post-auth reply_log does not log "User-Name" for PAP requests with Kerberos authentication In my case I have something like that Tue Sep 29 13:38:46 2009 Packet-Type = Access-Accept Attr1 = Val1 Attr2 = Val2 But User-Name is not logged. Is the a way to log it? For EAP-TLS apparently "User-Name" is part of reply attributes and it logs it correctly 3) If I do not want to use a separate file for every Client-Ip-Address detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d Is there a way to force it to log Client-IP-Address/NAS-Ip address into one file as prt of log message line? detailfile = ${radacctdir}/auth-detail-%Y%m%d It is just difficult to manage so many files for every NAS device Thanks a lot for you help. -- View this message in context: http://www.nabble.com/Logging-configuration-tp25668034p25668034.html Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi, slap perl into the post-auth section, configure a PERL module (post-auth section of the module) to open file, print the bits you need and then close the file. that file will be nicely populated with what you need. alan
Yes this works! I need to put perl module in 2 places in "post-auth" section 1st time near "reply_log" and 2nd time Post-Auth-Type REJECT { reply_log custom_module attr_filter.access_reject } Thanks a lot Alan Buxey wrote:
Hi,
slap perl into the post-auth section, configure a PERL module (post-auth section of the module) to open file, print the bits you need and then close the file. that file will be nicely populated with what you need.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/Logging-configuration-tp25668034p25668858.html Sent from the FreeRadius - User mailing list archive at Nabble.com.
What we need is logging all the real FINAL messages that RADIUS sends to the client Access-Rejects/Access-Accept in one line with simple detail about NAS and UserName:
Something like: Time,Access-Reject(or Accept),NAS-IP-Address,User-Name
I looked into "modules/detail.log" module and I have a couple of questions because apparently I have problem using it:
1. In post-auth I need to put it many places depending on unlang logic
Why? Only two - uncomment one that is already there and add one to REJECT.
2. In post-auth reply_log does not log "User-Name" for PAP requests with Kerberos authentication
In my case I have something like that Tue Sep 29 13:38:46 2009 Packet-Type = Access-Accept Attr1 = Val1 Attr2 = Val2 But User-Name is not logged. Is the a way to log it?
update reply { User-Name = "%{User-Name} }
3) If I do not want to use a separate file for every Client-Ip-Address detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d Is there a way to force it to log Client-IP-Address/NAS-Ip address into one file as prt of log message line? detailfile = ${radacctdir}/auth-detail-%Y%m%d
That will do it. Ivan Kalik Kalik Informatika ISP
Thanks a lot Ivan 1. Yes correct only in two places, it works. Thanks! 2. Great this works! I put this is "authorize" section. 3. It does not log NAS-Ip address because this is included as reply attribute. Should I update reply in the similar way as User-Name? Is this recommendation preferred over previous suggestion with Perl module which also works. Ivan Kalik wrote:
What we need is logging all the real FINAL messages that RADIUS sends to the client Access-Rejects/Access-Accept in one line with simple detail about NAS and UserName:
Something like: Time,Access-Reject(or Accept),NAS-IP-Address,User-Name
I looked into "modules/detail.log" module and I have a couple of questions because apparently I have problem using it:
1. In post-auth I need to put it many places depending on unlang logic
Why? Only two - uncomment one that is already there and add one to REJECT.
2. In post-auth reply_log does not log "User-Name" for PAP requests with Kerberos authentication
In my case I have something like that Tue Sep 29 13:38:46 2009 Packet-Type = Access-Accept Attr1 = Val1 Attr2 = Val2 But User-Name is not logged. Is the a way to log it?
update reply { User-Name = "%{User-Name} }
Great this works! I put this is "authorize" section. Is this the proper place to do it?
3) If I do not want to use a separate file for every Client-Ip-Address detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d Is there a way to force it to log Client-IP-Address/NAS-Ip address into one file as prt of log message line? detailfile = ${radacctdir}/auth-detail-%Y%m%d
That will do it.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/Logging-configuration-tp25668034p25668750.html Sent from the FreeRadius - User mailing list archive at Nabble.com.
1. Yes correct only in two places, it works. Thanks!
2. Great this works! I put this is "authorize" section.
3. It does not log NAS-Ip address because this is included as reply attribute. Should I update reply in the similar way as User-Name?
Yes. Add it to same update section.
Is this recommendation preferred over previous suggestion with Perl module which also works.
Perl gives you more flexibility. But this is simple enough for unlang. Ivan Kalik Kalik Informatika ISP
participants (3)
-
Alan Buxey -
Ivan Kalik -
leopold