radacct is not filled up
Hello! I authenticate a users against a mysql-db and everything is fine. Get entries in the radpostauth table but the radacct table stays emtpy, instead the logging is done in /usr/var/log/radius/radacct/192.168.1.254 # itx:/usr/var/log/radius/radacct/192.168.1.254 # ll insgesamt 284 -rw------- 1 root root 12420 12. Jul 16:38 auth-detail-20120712 -rw------- 1 root root 12420 13. Jul 19:35 auth-detail-20120713 -rw------- 1 root root 6210 14. Jul 23:21 auth-detail-20120714 -rw------- 1 root root 9078 15. Jul 17:06 auth-detail-20120715 -rw------- 1 root root 180883 16. Jul 17:26 auth-detail-20120716 -rw------- 1 root root 12640 17. Jul 00:43 auth-detail-20120717 -rw------- 1 root root 1242 3. Jul 22:35 reply-detail-20120703 -rw------- 1 root root 2008 12. Jul 16:38 reply-detail-20120712 -rw------- 1 root root 2008 13. Jul 19:35 reply-detail-20120713 -rw------- 1 root root 1004 14. Jul 23:21 reply-detail-20120714 -rw------- 1 root root 1004 15. Jul 13:39 reply-detail-20120715 -rw------- 1 root root 5041 16. Jul 17:26 reply-detail-20120716 -rw------- 1 root root 2016 17. Jul 00:43 reply-detail-20120717 I cannot find the place where in a configurationfile I can change the value to log into the radacct table. This is what I have in sql.conf: acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" Andreas
On Tue, Jul 17, 2012 at 5:59 AM, Andreas Meyer <anmeyer@anup.de> wrote:
Hello!
I authenticate a users against a mysql-db and everything is fine. Get entries in the radpostauth table but the radacct table stays emtpy, instead the logging is done in /usr/var/log/radius/radacct/192.168.1.254
# itx:/usr/var/log/radius/radacct/192.168.1.254 # ll insgesamt 284 -rw------- 1 root root 12420 12. Jul 16:38 auth-detail-20120712 -rw------- 1 root root 12420 13. Jul 19:35 auth-detail-20120713 -rw------- 1 root root 6210 14. Jul 23:21 auth-detail-20120714 -rw------- 1 root root 9078 15. Jul 17:06 auth-detail-20120715 -rw------- 1 root root 180883 16. Jul 17:26 auth-detail-20120716 -rw------- 1 root root 12640 17. Jul 00:43 auth-detail-20120717 -rw------- 1 root root 1242 3. Jul 22:35 reply-detail-20120703 -rw------- 1 root root 2008 12. Jul 16:38 reply-detail-20120712 -rw------- 1 root root 2008 13. Jul 19:35 reply-detail-20120713 -rw------- 1 root root 1004 14. Jul 23:21 reply-detail-20120714 -rw------- 1 root root 1004 15. Jul 13:39 reply-detail-20120715 -rw------- 1 root root 5041 16. Jul 17:26 reply-detail-20120716 -rw------- 1 root root 2016 17. Jul 00:43 reply-detail-20120717
I cannot find the place where in a configurationfile I can change the value to log into the radacct table.
Did you read http://wiki.freeradius.org/SQL-HOWTO ? Search for "accounting" -- Fajar
Hello! "Fajar A. Nugraha" <list@fajar.net> wrote:
On Tue, Jul 17, 2012 at 5:59 AM, Andreas Meyer <anmeyer@anup.de> wrote:
Hello!
I authenticate a users against a mysql-db and everything is fine. Get entries in the radpostauth table but the radacct table stays emtpy, instead the logging is done in /usr/var/log/radius/radacct/192.168.1.254
I cannot find the place where in a configurationfile I can change the value to log into the radacct table.
Did you read http://wiki.freeradius.org/SQL-HOWTO ?
Search for "accounting"
Yes, I read the SQL-Howto. Made a change in the dialup.conf from sql_user_name = "%{User-Name}" to sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" and the debug output shows that the radiusd is using stripped user-name. But the radacct is not filled up. All is written to the logfile in /usr/var/log/radius/radacct/192.168.1.254 I wonder if it might have something to do with the buffered-sql in /usr/etc/raddb/sites-available. I made no changes to that file. mysql> use radius; Database changed mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | badusers | | mtotacct | | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | | totacct | | userinfo | +------------------+ 12 rows in set (0.01 sec) Everything is fine and radcheck and radpostauth and userinfo and so on is written to the database exept for the radacct information. Andreas
On Tue, Jul 17, 2012 at 2:44 PM, Andreas Meyer <anmeyer@anup.de> wrote:
I cannot find the place where in a configurationfile I can change the value to log into the radacct table.
Did you read http://wiki.freeradius.org/SQL-HOWTO ?
Search for "accounting"
Yes, I read the SQL-Howto. Made a change in the dialup.conf from sql_user_name = "%{User-Name}" to sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}"
and the debug output shows that the radiusd is using stripped user-name. But the radacct is not filled up. All is written to the logfile in /usr/var/log/radius/radacct/192.168.1.254
I wonder if it might have something to do with the buffered-sql in /usr/etc/raddb/sites-available. I made no changes to that file.
Re-read the wiki page. If you HAVE read it correctly, you would've seen that you need to change something in that file. -- Fajar
Hello! "Fajar A. Nugraha" <list@fajar.net> wrote:
I wonder if it might have something to do with the buffered-sql in /usr/etc/raddb/sites-available. I made no changes to that file.
Re-read the wiki page. If you HAVE read it correctly, you would've seen that you need to change something in that file.
Hm, no luck with this one. I changed buffered.sql to log to sql, but it does not. accounting { # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # Cisco VoIP specific bulk accounting # pgsql-voip } ... [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /usr/etc/raddb/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] expand: %t -> Tue Jul 17 10:57:08 2012 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bitcorner-1 ... If I understand the buffered.sql right, logging is done to the detail file but how is it written to the database? Or how is the buffered.sql respected? Andreas
On Tue, Jul 17, 2012 at 4:08 PM, Andreas Meyer <anmeyer@anup.de> wrote:
Hm, no luck with this one. I changed buffered.sql to log to sql, but it
Did I EVER mention anything about buffered.sql? Was it EVER mentioned in the wiki page?
accounting { sql }
so accounting section has sql. That's good.
# Executing section post-auth from file /usr/etc/raddb/sites-enabled/default
See that? That's post-auth. That section is called after access-request packets are processed.
+- entering group post-auth {...} [reply_log] expand: /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] expand: %t -> Tue Jul 17 10:57:08 2012 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bitcorner-1
... and you didn't have ANYTHING in the log about accounting. Does your NAS send accounting packets? Accounting section is only called when radius receive accounting packets. Or is it that you want to log some data to sql in post-auth, instead of accounting? If so, then you need to modify the correct section (i.e. post-auth, not accounting). And the table modified will NOT be radacct, but radpostauth. See sql.conf and sql/mysql/dialup.conf for details, look for "postauth". You CAN change what's logged, and where, by editing the queries. -- Fajar
Hello! "Fajar A. Nugraha" <list@fajar.net> wrote:
On Tue, Jul 17, 2012 at 4:08 PM, Andreas Meyer <anmeyer@anup.de> wrote:
Hm, no luck with this one. I changed buffered.sql to log to sql, but it
Did I EVER mention anything about buffered.sql? Was it EVER mentioned in the wiki page?
accounting { sql }
so accounting section has sql. That's good.
# Executing section post-auth from file /usr/etc/raddb/sites-enabled/default
See that? That's post-auth. That section is called after access-request packets are processed.
Ok
+- entering group post-auth {...} [reply_log] expand: /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] expand: %t -> Tue Jul 17 10:57:08 2012 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bitcorner-1
... and you didn't have ANYTHING in the log about accounting.
Does your NAS send accounting packets? Accounting section is only called when radius receive accounting packets.
I fear the AP is not sending accounting packets at all. The only thing I can configure at the TP-Link AP is that it can communicate with the radiusserver at port 1812 for auth packets.
Or is it that you want to log some data to sql in post-auth, instead of accounting? If so, then you need to modify the correct section
not that I know of I have a section in radisud.conf to listen for type = acct
(i.e. post-auth, not accounting). And the table modified will NOT be radacct, but radpostauth. See sql.conf and sql/mysql/dialup.conf for details, look for "postauth". You CAN change what's logged, and where, by editing the queries.
I must say I am not sure, what information belongs to post-auth exactly and why. I promise I read the FAQ! Andreas
On Tue, Jul 17, 2012 at 4:54 PM, Andreas Meyer <anmeyer@anup.de> wrote:
I must say I am not sure, what information belongs to post-auth exactly and why. I promise I read the FAQ!
FR is very configurable. It's one of those things where the hardest part is making sure you know what you really want, and whether is technically possible (using ANY software). After that, translating it to configuration items is usually easier. -- Fajar
"Fajar A. Nugraha" <list@fajar.net> wrote:
On Tue, Jul 17, 2012 at 4:54 PM, Andreas Meyer <anmeyer@anup.de> wrote:
I must say I am not sure, what information belongs to post-auth exactly and why. I promise I read the FAQ!
FR is very configurable. It's one of those things where the hardest part is making sure you know what you really want, and whether is technically possible (using ANY software). After that, translating it to configuration items is usually easier.
Ok, thank you! I see this stuff is very complex and getting an overview is what I need to do. A good book about FR would come in handy. Andreas
On Tue, Jul 17, 2012 at 5:19 PM, Andreas Meyer <anmeyer@anup.de> wrote:
Ok, thank you! I see this stuff is very complex and getting an overview is what I need to do. A good book about FR would come in handy.
IMHO what you're doing is actually fine: start with a real system, ask when you have problems or doesn't understand what something works. That's how I started. The clearer you are about your requirement/problem, and the more detailed info you provided (e.g. debug log), the more likely others will be able to help you. There was a discussion in past about books on freeradius which you might also find useful (in particular, Alexander Clouter's comment): http://freeradius.1045715.n5.nabble.com/FreeRADIUS-Beginner-s-Guide-tt484677... -- Fajar
I fear the AP is not sending accounting packets at all. The only thing I can configure at the TP-Link AP is that it can communicate with the radiusserver at port 1812 for auth packets.
Good to know.... I had the same problem with TP Link... RADIUS auth works fine but accounting no-no On 17.7.2012 11:54, Andreas Meyer wrote:
Hello!
"Fajar A. Nugraha" <list@fajar.net> wrote:
On Tue, Jul 17, 2012 at 4:08 PM, Andreas Meyer <anmeyer@anup.de> wrote:
Hm, no luck with this one. I changed buffered.sql to log to sql, but it Did I EVER mention anything about buffered.sql? Was it EVER mentioned in the wiki page?
accounting { sql }
so accounting section has sql. That's good.
# Executing section post-auth from file /usr/etc/raddb/sites-enabled/default See that? That's post-auth. That section is called after access-request packets are processed. Ok
+- entering group post-auth {...} [reply_log] expand: /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] /usr/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/var/log/radius/radacct/192.168.1.254/reply-detail-20120717 [reply_log] expand: %t -> Tue Jul 17 10:57:08 2012 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bitcorner-1 ... and you didn't have ANYTHING in the log about accounting.
Does your NAS send accounting packets? Accounting section is only called when radius receive accounting packets. I fear the AP is not sending accounting packets at all. The only thing I can configure at the TP-Link AP is that it can communicate with the radiusserver at port 1812 for auth packets.
Or is it that you want to log some data to sql in post-auth, instead of accounting? If so, then you need to modify the correct section not that I know of
I have a section in radisud.conf to listen for type = acct
(i.e. post-auth, not accounting). And the table modified will NOT be radacct, but radpostauth. See sql.conf and sql/mysql/dialup.conf for details, look for "postauth". You CAN change what's logged, and where, by editing the queries. I must say I am not sure, what information belongs to post-auth exactly and why. I promise I read the FAQ!
Andreas - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Andreas Meyer -
Fajar A. Nugraha -
Marinko Tarlać