Anyone please, as this is driving me mad... Thx Nev ----- Original Message ----- From: Neville To: freeradius-users@lists.freeradius.org Sent: Sunday, February 07, 2010 1:28 PM Subject: Max-Monthly-Traffic Sorry for troubling everyone on this, but I cannot work out why Session-Octets-Limit is not calculating the differences between the counter and the check_item and setting an higher limited than the check_item? Log below Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Check item is greater than query result Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Authorized user FT-memjxa, check_item=262100000, counter=151223038 Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Sent Reply-Item for user FT-memjxa, Type=Session-Octets-Limit, value=263954010 Sun Feb 7 12:59:50 2010 : Info: ++[monthlytraffic] returns ok sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Session-Octets-Limit sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='%{%k}' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())" } Any pointers would help. Thx Nev
How does one go about monitoring freeradius in that to see if it is reaching process limits or max clients etc.. If I run it in debug mode it laces limits on it hat are not in normal mode. Is snmp the only way?
Le mardi 23 février 2010 à 13:39 -0500, Mark Jones a écrit :
How does one go about monitoring freeradius in that to see if it is reaching process limits or max clients etc..
I have made a cacti template, it won't do any sentry upon max-client or process-limit as you asked for. But it may help track access accept/reject... and accounting request. If your interested in it it can be found here http://forums.cacti.net/viewtopic.php?t=29880&highlight=freeradius but needs to be tweaked. (It uses radius status request instead of snmp) I know it's not what you asked for , but i thought it could help (And I'd be glad that someone can test it :p) regards
If I run it in debug mode it laces limits on it hat are not in normal mode.I know it
Is snmp the only way?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, 23 Feb 2010, Mark Jones wrote:
How does one go about monitoring freeradius in that to see if it is reaching process limits or max clients etc..
If I run it in debug mode it laces limits on it hat are not in normal mode.
Proactive network monitoring with Nagios and check_radius or check_radauth. ~BAS
Mark Jones wrote:
How does one go about monitoring freeradius in that to see if it is reaching process limits or max clients etc..
If I run it in debug mode it laces limits on it hat are not in normal mode.
Err... what does that mean? For general OS CPU / memory monitoring: see monit. For other RADIUS monitoring... the latest release of Monit includes FreeRADIUS plugins. Alan DeKok.
Sorry was in a hurry and did not notice my spelling mistakes. I am not looking to see if radius is failing or not running but as to how many of the options under the thread pool are being used at any given point in time. if I run the server with -X then it only runs one thread so that does not tell me what is going on. Also if the cleanup delay is too long so I am hitting the max_requests ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, February 23, 2010 4:17 PM Subject: Re: monitoring freeradius
Mark Jones wrote:
How does one go about monitoring freeradius in that to see if it is reaching process limits or max clients etc..
If I run it in debug mode it laces limits on it hat are not in normal mode.
Err... what does that mean?
For general OS CPU / memory monitoring: see monit.
For other RADIUS monitoring... the latest release of Monit includes FreeRADIUS plugins.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Mark Jones wrote:
I am not looking to see if radius is failing or not running but as to how many of the options under the thread pool are being used at any given point in time.
What does that mean? How many threads are being used? That information isn't currently available. It shouldn't be too hard to add, though.
if I run the server with -X then it only runs one thread so that does not tell me what is going on.
Also if the cleanup delay is too long so I am hitting the max_requests
Why would you set cleanup delay to be longer than 5 seconds? Alan DeKok.
I can't see why I would set it to longer then 5 seconds but some of the comments in the radius.conf file suggest there may be cases when you want it less then that. Which led me to wondering how you could check if you needed to. ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, February 24, 2010 4:45 AM Subject: Re: monitoring freeradius
Mark Jones wrote:
I am not looking to see if radius is failing or not running but as to how many of the options under the thread pool are being used at any given point in time.
What does that mean? How many threads are being used?
That information isn't currently available. It shouldn't be too hard to add, though.
if I run the server with -X then it only runs one thread so that does not tell me what is going on.
Also if the cleanup delay is too long so I am hitting the max_requests
Why would you set cleanup delay to be longer than 5 seconds?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have turned on reply_log option in the post-auth area. for both accepted and rejected packets. It is logging to the file successfully but it does not log the username or password. Wed Feb 24 10:06:47 2010 Packet-Type = Access-Accept Framed-Address = x.x.x.x Framed-Netmask = 255.255.255.255 Port-Limit = 1 Framed-Protocol = PPP User-Service-Type = Framed-User Framed-MTU = 1492 Framed-Routing = None Any ideas?
Is it possible to have the accounting packets that you would normally proxy to another server wrote to a file and then sent from the file. The same concept as we get with the buffered-sql config.
Mark Jones wrote:
Is it possible to have the accounting packets that you would normally proxy to another server wrote to a file and then sent from the file. The same concept as we get with the buffered-sql config.
raddb/sites-available/decoupled-accounting Alan DeKok.
Mark Jones wrote:
I have turned on reply_log option in the post-auth area. for both accepted and rejected packets.
It is logging to the file successfully but it does not log the username or password.
Does the reply contain the username and password? Likely not. Alan DeKok.
ok but in the same post-auth section if i use the sql_log facility it will write the username and password ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, February 24, 2010 11:01 AM Subject: Re: reply_log issue
Mark Jones wrote:
I have turned on reply_log option in the post-auth area. for both accepted and rejected packets.
It is logging to the file successfully but it does not log the username or password.
Does the reply contain the username and password?
Likely not.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok what I am trying to do.... We have a radius server that out las comunicate to for authentication and accounting. Accounting is not stored localy it is wrote to an sql database on another server. We have setup the buffered-sql section so that accounting is wrote to a local detail file then read from the file and wrote to the remote sql server. the reason we do this is if the sql server is under heavy load or does not respond in a timly manor then the accounting accept message is delayed or never sent back to the nas so it can end up marking the radius server as down which is bad. So the buffered sql has fixed that potential problem. The current problem is to do with post-auth rejects and accepts being logged to the remote sql server. We are in the same situation that if the remote server does not accept the write of the post-auth then the user that tried to login actually gets rejected. So I want to write the items to a file then send them to the sql server as available. I know I can do this with the sql_log feature and radsqlrealy but would prefer to do it with the radius server itself not via external program. Does that make sense? ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, February 24, 2010 11:14 AM Subject: Re: reply_log issue
Mark Jones wrote:
ok but in the same post-auth section if i use the sql_log facility it will write the username and password
That's nice.
You have been careful to discuss only problems. I suggest stating your requirements instead.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Mark Jones wrote:
We have a radius server that out las comunicate to for authentication and accounting.
Please review your posts for spelling and grammer. It's difficult to understand your questions when they are full of nonsensical phrases.
Accounting is not stored localy it is wrote to an sql database on another server. We have setup the buffered-sql section so that accounting is wrote to a local detail file then read from the file and wrote to the remote sql server.
OK...
the reason we do this is if the sql server is under heavy load or does not respond in a timly manor then the accounting accept message is delayed or never sent back to the nas so it can end up marking the radius server as down which is bad. So the buffered sql has fixed that potential problem.
Yes, that's how it's intended to be used.
The current problem is to do with post-auth rejects and accepts being logged to the remote sql server. We are in the same situation that if the remote server does not accept the write of the post-auth then the user that tried to login actually gets rejected. So I want to write the items to a file then send them to the sql server as available.
See the sql_log module. raddb/modules/sql_log, and "man rlm_sql_log". It does exactly this.
I know I can do this with the sql_log feature and radsqlrealy but would prefer to do it with the radius server itself not via external program.
Does that make sense?
Yes, but that's not supported right now in the main server. It's actually pretty hard to do. A separate radsqlrelay program isn't very complicated to run. Alan DeKok.
On Wed, Feb 24, 2010 at 1:32 AM, Alan DeKok <aland@deployingradius.com> wrote:
Neville wrote:
Anyone please, as this is driving me mad...
2^31 issues? Check the code for unsigned int...
So you're suggesting to change the source code for rlm_sqlcounter and recompile?
participants (6)
-
Alan DeKok -
Alexandre Chapellon -
Brian A. Seklecki -
Fajar A. Nugraha -
Mark Jones -
Neville