Problem syncing radius.logs with radrelay
Hello All! FR Version: 1.1.3 OS Version: Fedora Core 5 cmd line for radrelay = /usr/bin/radrelay -n rad1_server -a /var/log/radacct -d /etc/raddb detail.relay We've recently switched to FreeRadius from Cistron, and we didn't have this problem with Cistron. So, I'm hoping someone can help. We are running 2 servers with radrelay. When a user gets authenticated on server #1, it logs their "Login OK" in the radius.log file, but does NOT log it on server #2 (and vise versa). So I would like to know if there's a way to have the log files on both servers sync up? And why did it work on Cistron and not with FreeRadius? Thank in advance for any help. --John Brittain <john@dncsi.com>
John Brittain wrote:
We are running 2 servers with radrelay. When a user gets authenticated on server #1, it logs their "Login OK" in the radius.log file, but does NOT log it on server #2 (and vise versa). So I would like to know if there's a way to have the log files on both servers sync up? And why did it work on Cistron and not with FreeRadius?
radrelay copies accounting packets, not authentication packets. In FreeRADIUS, the "Login OK" message appears in radius.log ONLY when the server sends an Access-Accept. In any case, the radius.log file is informative, not definitive. If you're using it for any purpose other than having admins occasionally reading it, that's wrong. You should be looking at the accounting logs to see what the users are really doing. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
radrelay copies accounting packets, not authentication packets. In FreeRADIUS, the "Login OK" message appears in radius.log ONLY when the server sends an Access-Accept.
In any case, the radius.log file is informative, not definitive. If you're using it for any purpose other than having admins occasionally reading it, that's wrong. You should be looking at the accounting logs to see what the users are really doing.
Alan DeKok. --
Alan, It's being used for incorrect logins and other information, and we had a web page that pierced that file when a customer called with a problem. Now, we have to look at both files to see the errors/information. That's why I was asking if there was a way to have both radius.log files sync'd like it was with Cistron. How did it stay sync'd in Cistron? Was it the radrelay program? If so, I guess I could do some hacking on that program to satisfy our needs. Thanks. --John
John Brittain wrote:
It's being used for incorrect logins and other information, and we had a web page that pierced that file when a customer called with a problem. Now, we have to look at both files to see the errors/information.
Having a web server parse (or even have read access to) the "radius.log" file is a bad idea. All of the information the web page needs could be put into an SQL database.
That's why I was asking if there was a way to have both radius.log files sync'd like it was with Cistron. How did it stay sync'd in Cistron? Was it the radrelay program?
No. Someone at your site probably wrote a script to copy the data back and forth. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On Sat 03 Feb 2007 23:57, John Brittain wrote:
radrelay copies accounting packets, not authentication packets. In FreeRADIUS, the "Login OK" message appears in radius.log ONLY when the server sends an Access-Accept.
In any case, the radius.log file is informative, not definitive. If you're using it for any purpose other than having admins occasionally reading it, that's wrong. You should be looking at the accounting logs to see what the users are really doing.
Alan DeKok. --
Alan,
It's being used for incorrect logins and other information, and we had a web page that pierced that file when a customer called with a problem. Now, we have to look at both files to see the errors/information.
That's why I was asking if there was a way to have both radius.log files sync'd like it was with Cistron. How did it stay sync'd in Cistron? Was it the radrelay program? If so, I guess I could do some hacking on that program to satisfy our needs.
We log (incorrect only) auth requests to a sql database for exactly this reason. Much easier than parsing a log file if you have a web interface.. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
participants (3)
-
Alan DeKok -
John Brittain -
Peter Nixon