Module sqlippool and logs
Hello all, I'm using freeradius 3.0.19. I have three sqlippool modules configured and working in my radius server (for ipv4, ipv6 and ipv6pd). For now, I want to enable the logs via linelog for the three instances, but I'm getting messages only from the first one, even when I declare three linelog instances. Here is the debug:
From IPV4 module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: EXPAND Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: --> Released IP x.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV4] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) -> TRUE (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: [linelog] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: } # if (control:Module-Success-Message) = ok
From IPV6PD module:
(67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: EXPAND Released IPv6PD %{Delegated-IPv6-Prefix} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: --> Released IPv6PD 2804:xxxx/56 (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV6PD] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> /var/log/radius/radius.log The linelog config is the same for both instances: linelog linelogv6 { filename = ${logdir}/radius.log escape_filenames = no permissions = 0600 format = "%t %{control:Module-Success-Message}" } The module SQLIPPOOL expands correctly to the IPv6PD address, but the linelog is only getting the data from the first IPv4 instance. Is it possible to get the last %{control:Module-Success-Message} instead of the first one? Regards, Rafael
On Aug 26, 2019, at 3:36 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I'm using freeradius 3.0.19. I have three sqlippool modules configured and working in my radius server (for ipv4, ipv6 and ipv6pd).
OK...
For now, I want to enable the logs via linelog for the three instances, but I'm getting messages only from the first one, even when I declare three linelog instances.
You can put the log module immediately after each ippool module: if (a) { ippool_a linelog_a } elsif (b) { ippool_b linenlog_b } etc.
Here is the debug: From IPV4 module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: EXPAND Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})
No, that is NOT the debug we want. All of the documentation says to use "radiusd -X". Why are you using something else? Where do we need to put that documentation so that (a) you will read it, and (b) follow its instructions? Alan DeKok.
Em ter, 27 de ago de 2019 às 09:42, Alan DeKok <aland@deployingradius.com> escreveu:
On Aug 26, 2019, at 3:36 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I'm using freeradius 3.0.19. I have three sqlippool modules configured and working in my radius server (for ipv4, ipv6 and ipv6pd).
OK...
For now, I want to enable the logs via linelog for the three instances, but I'm getting messages only from the first one, even when I declare three linelog instances.
You can put the log module immediately after each ippool module:
if (a) { ippool_a linelog_a } elsif (b) { ippool_b linenlog_b }
etc.
I can't use this approach because I need to process both the ippool modules: IPV4 if (control:Module-Success-Message) { linelog } IPV6 if (control:Module-Success-Message) { linelogv6 }
Here is the debug: From IPV4 module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: EXPAND Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})
No, that is NOT the debug we want. All of the documentation says to use "radiusd -X".
Why are you using something else? Where do we need to put that documentation so that (a) you will read it, and (b) follow its instructions?
My radius server is in production, so I got the debug from raddebug, to prevent impacting service availability. I'm sorry for that. Here is from "radius -X" IPv4 ippool module + linelog: (134) IPV4: Executing query: COMMIT rlm_sql (sql): Released connection (2) (134) IPV4: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (134) IPV4: --> Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#1047721 port 771754200 user xxxxx@xxxxxx.xxx.xx) (134) [IPV4] = ok (134) if (control:Module-Success-Message) { (134) if (control:Module-Success-Message) -> TRUE (134) if (control:Module-Success-Message) { (134) linelog: EXPAND %t %{control:Module-Success-Message} (134) linelog: --> Tue Aug 27 13:50:43 2019 Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#1047721 port 771754200 user xxxxx@xxxxxx.xxx.xx) (134) linelog: EXPAND /var/log/radius/radius.log IPv6 ippool module + linelogv6: (134) IPV6: EXPAND Allocated IPv6PD: %{reply:Delegated-IPv6-Prefix} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (134) IPV6: --> Allocated IPv6PD: 2804:xxxxxxx/56 from SPF (did cli BRAS-31#1047721 port 771754200 user xxxxx@xxxxxx.xxx.xx) (134) [IPV6] = ok (134) if (control:Module-Success-Message) { (134) if (control:Module-Success-Message) -> TRUE (134) if (control:Module-Success-Message) { (134) linelogv6: EXPAND %t %{control:Module-Success-Message} (134) linelogv6: --> Tue Aug 27 13:50:43 2019 Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#1047721 port 771754200 user xxxxx@xxxxxx.xxx.xx) (134) linelogv6: EXPAND /var/log/radius/radius.log (134) linelogv6: --> /var/log/radius/radius.log (134) [linelogv6] = ok (134) } # if (control:Module-Success-Message) = ok
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 27, 2019, at 12:56 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I can't use this approach because I need to process both the ippool modules:
IPV4 if (control:Module-Success-Message) { linelog
Then do: update control { &Module-Success-Message -= ANY } Which deletes it. Then, the next module can set it and use it.
} IPV6 if (control:Module-Success-Message) { linelogv6 }
My radius server is in production, so I got the debug from raddebug, to prevent impacting service availability. I'm sorry for that.
I understand, but it's a pain. This is why people should be running test systems. i.e. *don't* play games with your production system! Run tests! Alan DeKok.
Em ter, 27 de ago de 2019 às 14:43, Alan DeKok <aland@deployingradius.com> escreveu:
On Aug 27, 2019, at 12:56 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I can't use this approach because I need to process both the ippool modules:
IPV4 if (control:Module-Success-Message) { linelog
Then do:
update control { &Module-Success-Message -= ANY }
I dit it: ... IPV4 if (control:Module-Success-Message) { linelog update control { &Module-Success-Message -= ANY } } IPV6 if (control:Module-Success-Message) { linelogv6 update control { &Module-Success-Message -= ANY } } ... But the log message from linelog is using the first one: (104) IPV4: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (104) IPV4: --> Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#MA56T_H23_01 atm 0/15/0/027:8.35 port 721422845 user xxxxx@xxxxxx.xxx.xx) (104) [IPV4] = ok (104) if (control:Module-Success-Message) { (104) if (control:Module-Success-Message) -> TRUE (104) if (control:Module-Success-Message) { (104) linelog: EXPAND %t %{control:Module-Success-Message} (104) linelog: --> Tue Aug 27 15:03:16 2019 Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#MA56T_H23_01 atm 0/15/0/027:8.35 port 721422845 user xxxxx@xxxxxx.xxx.xx) (104) linelog: EXPAND /var/log/radius/radius.log (104) linelog: --> /var/log/radius/radius.log (104) [linelog] = ok (104) update control { (104) &Module-Success-Message -= ANY (104) } # update control = noop (104) } # if (control:Module-Success-Message) = ok (104) IPV6: EXPAND Allocated IPv6PD: %{reply:Delegated-IPv6-Prefix} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (104) IPV6: --> Allocated IPv6PD: 2804:xxxxx::/56 from SPF (did cli BRAS-31#MA56T_H23_01 atm 0/15/0/027:8.35 port 721422845 user xxxxx@xxxxxx.xxx.xx) (104) [IPV6] = ok (104) if (control:Module-Success-Message) { (104) if (control:Module-Success-Message) -> TRUE (104) if (control:Module-Success-Message) { (104) linelogv6: EXPAND %t %{control:Module-Success-Message} (104) linelogv6: --> Tue Aug 27 15:03:16 2019 Allocated IP: 187.x.x.x from SPF (did cli BRAS-31#MA56T_H23_01 atm 0/15/0/027:8.35 port 721422845 user xxxxx@xxxxxx.xxx.xx) (104) linelogv6: EXPAND /var/log/radius/radius.log (104) linelogv6: --> /var/log/radius/radius.log (104) [linelogv6] = ok (104) update control { (104) &Module-Success-Message -= ANY (104) } # update control = noop (104) } # if (control:Module-Success-Message) = ok (104) [exec] = noop (104) } # post-auth = ok
Which deletes it. Then, the next module can set it and use it.
} IPV6 if (control:Module-Success-Message) { linelogv6 }
My radius server is in production, so I got the debug from raddebug, to prevent impacting service availability. I'm sorry for that.
I understand, but it's a pain. This is why people should be running test systems.
i.e. *don't* play games with your production system! Run tests!
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 27, 2019, at 2:49 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
Em ter, 27 de ago de 2019 às 14:43, Alan DeKok <aland@deployingradius.com> escreveu:
On Aug 27, 2019, at 12:56 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I can't use this approach because I need to process both the ippool modules:
IPV4 if (control:Module-Success-Message) { linelog
Then do:
update control { &Module-Success-Message -= ANY }
I dit it: ... IPV4 if (control:Module-Success-Message) { linelog update control { &Module-Success-Message -= ANY
Hmm... maybe "!*" then instead of "-=" Alan DeKok.
Em ter, 27 de ago de 2019 às 16:02, Alan DeKok <aland@deployingradius.com> escreveu:
On Aug 27, 2019, at 2:49 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
Em ter, 27 de ago de 2019 às 14:43, Alan DeKok <aland@deployingradius.com> escreveu:
On Aug 27, 2019, at 12:56 PM, Rafael Ganascim <rganascim@gmail.com> wrote:
I can't use this approach because I need to process both the ippool modules:
IPV4 if (control:Module-Success-Message) { linelog
Then do:
update control { &Module-Success-Message -= ANY }
I dit it: ... IPV4 if (control:Module-Success-Message) { linelog update control { &Module-Success-Message -= ANY
Hmm... maybe "!*" then instead of "-="
Its solved. : ))) I even used the same linelog module. Here is the result from radius.log (from a acct-stop packet): Tue Aug 27 16:15:33 2019 Released IP 201.x.x.x (did cli BRAS-31#MA56_JAC08 atm 15/21:8.35 user xxxx@xxxx.xxx.xx) Tue Aug 27 16:15:33 2019 Released IPv6 2804:xxxxxx/64 (did cli BRAS-31#MA56_JAC08 atm 15/21:8.35 user xxxx@xxxx.xxx.xx) Tue Aug 27 16:15:33 2019 Released IPv6PD 2804:xxxxxx/56 (did cli BRAS-31#MA56_JAC08 atm 15/21:8.35 user xxxx@xxxx.xxx.xx) Final configuration: IPV4 if (control:Module-Success-Message) { linelog update control { &Module-Success-Message !* ANY } } IPV6 if (control:Module-Success-Message) { linelog update control { &Module-Success-Message !* ANY } } Many thanks Alan.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Regards, Rafael
participants (2)
-
Alan DeKok -
Rafael Ganascim