McNutt, Justin M. wrote:

I've been seeing some unexplained failures to authenticate 802.1X clients when my system is under heavier load, and I suspect that I don't have enough threads running. For reference, I currently have four servers in a load balanced group with identical configs.

I hope you're doing load-balancing that is aware of EAP.

Thread settings are these:

max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0

That should usually be OK.

We have about 14,500 wireless clients at peak times, though that number will climb, I'm sure.

i.e. about 3.5K per RADIUS server. Unless the session timeouts are 2 minutes, that should be fine.

Is there a rule of thumb that will tell me how many threads I should have (max_servers)?

Not really. As an FYI, I know of a large accounting system which was running 400 threads 12 years ago. :) *That* is a busy system.

Also, I suspect that there have been authentication failures due to all threads on a server being busy. Is there a good way to confirm that?

The server won't log a message, unfortunately.

I've poked around in the radiusd logs a bit, but haven't found much, other than the odd "Login failed" with no reason given. (For "normal" failures, there are two messages, one of which has a cause like "bad password" or "account locked out" or some such thing.)

Increasing the number of threads might help. It won't hurt. Alan DeKok.