I'm using this section. ... Post-Auth-Type REJECT { ... sql_auth } ... Records drop to database when access is rejected. But I want to see reason of rejection. As in radius.log. On Fri, Apr 27, 2012 at 11:17:30AM +0200, Alan DeKok wrote:

George Koulyabin wrote:

...

I tried to save results of process access requests to SQL database using postauth_query. I used 'Module-Failure-Message' attribute as a comment for rejected requests. The message 'rlm_pap: CLEAR TEXT password check failed' drops to database when password is wrong, for example. But attribute 'Module-Failure-Message' ( and attribute 'Module-Success-Message') is empty when user not found, for example. And other reasons may be. How can I save comments for rejected requests?

Use "the Post-Auth-Type Reject" section.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I do it. But I see comments in some cases only. This attribute is filled when access rejected with wrong password. But this attribute is empty when user is not found (unknown username). Does other attribute (or hint) exist for cases when Module-Failure-Message is empty? On Fri, Apr 27, 2012 at 02:00:42PM +0200, Alan DeKok wrote:

George Koulyabin wrote:

...

Records drop to database when access is rejected. But I want to see reason of rejection. As in radius.log.

Edit the SQL queries to include Module-Failure-Message.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I tried to implement Your advice. 1) Changes in configuration: authorize { ... sql_auth if ( notfound ) { update control { Module-Failure-Message := 'User not found' } } ... } 2) Run RADIUS in debugging mode Some debugging info: ... [sql_auth] returns notfound +++? if (notfound ) ? Evaluating (notfound ) -> TRUE +++? if (notfound ) -> TRUE +++- entering if (notfound ) {...} ++++[control] returns notfound +++- if (notfound ) returns notfound ... And 'Module-Failure-Message' is empty. Did I make mistake in configuration? On Fri, Apr 27, 2012 at 03:11:27PM +0200, Alan DeKok wrote:

As always, run the server in debugging mode to see what it's doing.

If the user isn't found, you'll probably have to add a message yourself.

No, I used reference to %{Module-Failure-Message}. I changed reference from %{Module-Failure-Message} to %{control:Module-Failure-Message} and message 'User not found' droped to database. It works. But when I sent request with wrong password, message 'Bad password' did not drop to database because module saved message to %{Module-Failure-Message}. I found <list> what must be updated (after set of experiments). ... authorize { sql_auth if ( notfound ) { # Update 'request' as a <list> update request { # Replace attribute Module-Failure-Message = 'User not found' } } } ... Thanks for Your help. On Sat, Apr 28, 2012 at 08:54:06AM +0200, Alan DeKok wrote:

How are you referencing it? You added it to the "control" list. Are you using %{control:Module-Failure-Message} ?

Alan DeKok.