Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 10/13/2011 09:23 AM, siguillaume wrote:
Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you
Be more specific. What is slow? Are you using an SQL database to store accounting? If so, ensure the database is fast enough - check you have enough indexing, but not too much. Are you using LDAP or SQL to provide authentication data? Again, check these are fast enough. FreeRADIUS is very very fast. But it can only answer as quickly as the database it is using.
On 13 Oct 2011, at 10:23, siguillaume wrote:
Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui
What databases are you running? What authentication protocols are you using? Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Ok, Thanks. We use mysql as database. Each server has his own database server. The protocols of authentification which are activated: chap, mschap and eap. But, we are in a test step, so we least all requests to be accepted by radius. Date: Thu, 13 Oct 2011 02:13:17 -0700 From: ml-node+s1045715n4898575h19@n5.nabble.com To: gsigui@live.fr Subject: Re: Workload in freeradius platform On 13 Oct 2011, at 10:23, siguillaume wrote:Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui What databases are you running? What authentication protocols are you using? Arran Cudbard-Bell [hidden email] Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ ! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... To unsubscribe from Workload in freeradius platform, click here. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 13/10/11 10:20, siguillaume wrote:
Ok, Thanks. We use mysql as database. Each server has his own database server.
The protocols of authentification which are activated: chap, mschap and eap. But, we are in a test step, so we least all requests to be accepted by radius.
Again: WHAT is going slow?
What is going slow? Answer: The response of BAS's requests by freeradius.
Date: Thu, 13 Oct 2011 11:56:35 +0100 From: p.mayers@imperial.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: Workload in freeradius platform
On 13/10/11 10:20, siguillaume wrote:
Ok, Thanks. We use mysql as database. Each server has his own database server.
The protocols of authentification which are activated: chap, mschap and eap. But, we are in a test step, so we least all requests to be accepted by radius.
Again: WHAT is going slow? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Freeradius threat the requests of BAS slowly after adding a second BAS. From: gsigui@live.fr To: freeradius-users@lists.freeradius.org Subject: RE: Workload in freeradius platform Date: Thu, 13 Oct 2011 17:29:25 +0000 What is going slow? Answer: The response of BAS's requests by freeradius.
Date: Thu, 13 Oct 2011 11:56:35 +0100 From: p.mayers@imperial.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: Workload in freeradius platform
On 13/10/11 10:20, siguillaume wrote:
Ok, Thanks. We use mysql as database. Each server has his own database server.
The protocols of authentification which are activated: chap, mschap and eap. But, we are in a test step, so we least all requests to be accepted by radius.
Again: WHAT is going slow? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 13/10/11 18:29, Guillaume Sigui wrote:
What is going slow? Answer: The response of BAS's requests by freeradius.
Are you deliberately trying to be difficult? Please give more information. Be specific. What is a BAS? What requests is it making? Authentication or accounting? What authentication types are you using? Are all requests going slow? Some of them? How many? And most importantly: Please capture a debug of a request going slow: radiusd -X | tee log # do an auth ctrl+c # read "log" - see why it's going slow
On 13 Oct 2011, at 19:41, Phil Mayers wrote:
On 13/10/11 18:29, Guillaume Sigui wrote:
What is going slow? Answer: The response of BAS's requests by freeradius.
Are you deliberately trying to be difficult?
Mmm I think we have a cronic case of assholeitus. Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Ok, thanks. I give more details in the files attached. Guillaume Sigui Date: Thu, 13 Oct 2011 18:53:16 -0700 From: ml-node+s1045715n4901160h54@n5.nabble.com To: gsigui@live.fr Subject: Re: Workload in freeradius? platform Guillaume Sigui wrote:
What is going slow?
Answer: The response of BAS's requests by freeradius.
My tolerance for this kind of nonsense has reached it's limit. He's been unsubscribed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... To unsubscribe from Workload in freeradius platform, click here. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... Sent from the FreeRadius - User mailing list archive at Nabble.com.
siguillaume wrote:
Ok, thanks. I give more details in the files attached. ... *DESCRIPTION OF WORKLOAD PROBLEM WITH FREERADIUS.pdf* (291K) Download Attachment
I wish you were joking, but I'm sure you're not. As a hint, posting PDFs is rude. *NO ONE* else is doing it. Go read the documentation for how to ask sane questions. If you keep this up, I'll unsubscribe nabble.com, too. Very little of anything worthwhile comes from there. Alan DeKok.
On 14 Oct 2011, at 16:41, Alan DeKok wrote:
siguillaume wrote:
Ok, thanks. I give more details in the files attached. ... *DESCRIPTION OF WORKLOAD PROBLEM WITH FREERADIUS.pdf* (291K) Download Attachment
I wish you were joking, but I'm sure you're not.
As a hint, posting PDFs is rude. *NO ONE* else is doing it.
Go read the documentation for how to ask sane questions.
If you keep this up, I'll unsubscribe nabble.com, too. Very little of anything worthwhile comes from there.
Really though. The majority of the posts from nabble are just idiotic. There's something about actually taking the time to subscribe to the mailing list which seems to filter out a lot of the time wasters. -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
If you keep this up, I'll unsubscribe nabble.com, too. Very little of anything worthwhile comes from there.
Really though. The majority of the posts from nabble are just idiotic. There's something about actually taking the time to subscribe to the mailing list which seems to filter out a lot of the time wasters.
GMANE is what I use, so do not think about nuking that. If you just move this to USENET, that probably will fix a huge chunk of the noise problem and then you also can use killfiles...*hint* :) Cheers -- Alexander Clouter .sigmonster says: Take your Senator to lunch this week.
Ok, sorry. I explain below with more details: ----------------------------------------------------------------------------------------------------------------------------------------- DESCRIPTION OF WORKLOAD PROBLEM WITH FREERADIUS PLATFORM I- OBJECTIVES It was a project that was implemented for an ISP to authenticate, to authorize and to account their ADSL’s Subscribers. The main objective is to integrate radius in the process of attribution of IP Address to ADSL Subscribers. This integration can be described by the steps follows: Before integration of Radius Platform: 1- The subscribers are queries the BAS to affect an IP address 2- The BAS affects to this subscriber, an IP Address 3- The subscribers are connected to Internet After integration of Radius Platform: 1- The subscribers are queries the BAS to affect an IP address 2- The BAS transfers these requests to Radius platform 3- The Radius platform authenticates this subscriber. If he is authorized, the Radius starts accounting; if not, BAS denied access of this subscriber. 4- When the authentication is on success, the BAS affects an IP Address of this subscriber 5- The subscribers are connected to Internet 6- Once subscriber terminates his connection to internet, the BAS send a request to Radius for stopping accounting II- PROBLEM There are three BAS. It’s Alcatel BAS SMS 1800. All of subscribers are affected to one BAS as follow: - BAS n°1: 8000 subscribers - BAS n°2: 3000 subscribers - BAS n°3 : 2000 subscribers After transferring a first BAS’s requests to a RADIUS platform, it’s work well. But, after configuring a second BAS to transfer his requests, the radius platform started to work slowly. The authentification process has become slow. III- INTERNAL ARCHITECTURE OF RADIUS PLATFORM There are eight virtual servers based on KVM: - 02 authentication’s servers - 02 accounting’s servers, - each server has his own database server, so there are 04 database servers. It's Mysql 5. Authentication and Accounting are configuring with Freeradius. IV- LOGS AND CONFIGURATION 1. Radiusd –X | tee log It's very long. So i give it, to an another file. View the file attached radius-X.log. 2. BAS’s Configuration On each BAS, we have done this configuration: context ISP domain ISP_domain1 domain ISP_domain2 aaa authentication subscriber radius aaa accounting subscriber radius radius server IP_authentication_server1 key alcatel radius server IP_authentication_server2 key alcatel radius algorithm round-robin radius accounting server IP_accounting_server1 key alcatel radius accounting server IP_accounting_server2 key alcatel radius accounting algorithm round-robin radius attribute NAS-IP-Address interface cisco Thanks a lot, Guillaume Sigui
Date: Fri, 14 Oct 2011 16:41:07 +0200 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: Workload in freeradius? platform
siguillaume wrote:
Ok, thanks. I give more details in the files attached. ... *DESCRIPTION OF WORKLOAD PROBLEM WITH FREERADIUS.pdf* (291K) Download Attachment
I wish you were joking, but I'm sure you're not.
As a hint, posting PDFs is rude. *NO ONE* else is doing it.
Go read the documentation for how to ask sane questions.
If you keep this up, I'll unsubscribe nabble.com, too. Very little of anything worthwhile comes from there.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, Oct 14, 2011 at 10:47 PM, Guillaume Sigui <gsigui@live.fr> wrote:
Ok, sorry. I explain below with more details:
Guillaume, let me put this another way. Most of the things you've wrote is irrelevant to this list. This list is freeradius mailing list. Not alcatel list, not mysql list, not some support for an ISP. You asked a question "why is freeradius slow". Then you were given a response "which part of it is slow". Then you posted a lot of information, but none of which is really relevant. Then you posted log of radiusd -X starting up, but without it receiving any packets at all, thus making it almost useless for diagnostic purposes. Do you understand now why some people here have expressed frustration reading your post, even to go as far as unsubscribing you? I'm going to assume that you don't deliberately intend to do so, and that you simply don't know where to look. Here's a hint: when freeradius is slow, usually it's the backend that's slow. The backend can be: - a database (e.g. Mysql) - ldap - another radius server (when running proxy configuration) How can you find out what's slow? One way (but not the only way) would be: - run freeradius in debugging mode - send access-request and/or accounting packets for ONE session - see where it's slow Usually that means you need to have a test server, with freeradius installed, using the same backend that your production server uses. After you find out what's causing the slowness, then freeradius-related part is complete. You'll need to work on whatever it is on the backend that's causing the slowness. Now, since you say
- each server has his own database server, so there are 04 database servers. It's Mysql 5.
Then most likely the problem is in the database. Usual causes: - there are too many accounting records (e.g. several millions), and your configuration scans the records every time an authentication occurs (e.g. for simultaneous-check) - the table structurs has non-optimal index, or your queries are non-optimal that it uses many full table scans - your db server performance simply sucks Are you still with me so far? Now if my previous guess is correct, then to further diagnose this problem you need a DBA. If you don't have the skills needed, hire one. A DBA would be able to determine whether or not MySQL is REALLY the cause of slowness, and he'll also be able to do some steps to improve the performance. If you DON'T have a DBA, and DON'T intend to hire one, then I can only say sorry, but no ammount of mail posted to any mailing list will be able to help you. You'll just annoy others. -- Fajar
Ok, Thanks. We have started a new test today. In file attached, i give the results of radiusd -X | tee log, on the both authentication servers. We see some errors but don't understand as well. Date: Fri, 14 Oct 2011 16:36:19 -0700 From: ml-node+s1045715n4904200h94@n5.nabble.com To: gsigui@live.fr Subject: Re: Workload in freeradius? platform On Fri, Oct 14, 2011 at 10:47 PM, Guillaume Sigui <[hidden email]> wrote:
Ok, sorry. I explain below with more details:
Guillaume, let me put this another way. Most of the things you've wrote is irrelevant to this list. This list is freeradius mailing list. Not alcatel list, not mysql list, not some support for an ISP. You asked a question "why is freeradius slow". Then you were given a response "which part of it is slow". Then you posted a lot of information, but none of which is really relevant. Then you posted log of radiusd -X starting up, but without it receiving any packets at all, thus making it almost useless for diagnostic purposes. Do you understand now why some people here have expressed frustration reading your post, even to go as far as unsubscribing you? I'm going to assume that you don't deliberately intend to do so, and that you simply don't know where to look. Here's a hint: when freeradius is slow, usually it's the backend that's slow. The backend can be: - a database (e.g. Mysql) - ldap - another radius server (when running proxy configuration) How can you find out what's slow? One way (but not the only way) would be: - run freeradius in debugging mode - send access-request and/or accounting packets for ONE session - see where it's slow Usually that means you need to have a test server, with freeradius installed, using the same backend that your production server uses. After you find out what's causing the slowness, then freeradius-related part is complete. You'll need to work on whatever it is on the backend that's causing the slowness. Now, since you say
- each server has his own database server, so there are 04 database servers.
It's Mysql 5.
Then most likely the problem is in the database. Usual causes: - there are too many accounting records (e.g. several millions), and your configuration scans the records every time an authentication occurs (e.g. for simultaneous-check) - the table structurs has non-optimal index, or your queries are non-optimal that it uses many full table scans - your db server performance simply sucks Are you still with me so far? Now if my previous guess is correct, then to further diagnose this problem you need a DBA. If you don't have the skills needed, hire one. A DBA would be able to determine whether or not MySQL is REALLY the cause of slowness, and he'll also be able to do some steps to improve the performance. If you DON'T have a DBA, and DON'T intend to hire one, then I can only say sorry, but no ammount of mail posted to any mailing list will be able to help you. You'll just annoy others. -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... To unsubscribe from Workload in freeradius platform, click here. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Workload-in-freeradius-platform-tp48... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Mon, Oct 24, 2011 at 4:40 PM, siguillaume <gsigui@live.fr> wrote:
Ok, Thanks. We have started a new test today. In file attached, i give the results of radiusd -X | tee log, on the both authentication servers.
I explicitly wrote in my last reply "Then you posted log of radiusd -X starting up, but without it receiving any packets at all, thus making it almost useless for diagnostic purposes." And you do the exact same thing again? I give up. Seems like nothing I say can get through. My last bit of advice: get an expert to fix it for you. Don't even bother trying to fix it yourself. Period. -- Fajar
Ok, Thanks. We use mysql as database. Each server has his own database server. The protocols of authentification which are activated: chap, mschap and eap. But, we are in a test step, so we least all requests to be accepted by radius. From: a.cudbardb@freeradius.org Subject: Re: Workload in freeradius platform Date: Thu, 13 Oct 2011 11:11:47 +0200 To: freeradius-users@lists.freeradius.org On 13 Oct 2011, at 10:23, siguillaume wrote:Hi, We have installed a new freeradius with four servers: 02 for authentification and 02 for Accounting. This plateform is for worked interactively with three Alcaltel BAS. After configuration, we try with one BAS, and it's work very well. But, when we add a second BAS, it's been very slowly. We remark a problem with performance. Thanks for you answered. Best regards, Guillaume Sigui What databases are you running? What authentication protocols are you using? Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ ! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (7)
-
Alan DeKok -
Alexander Clouter -
Arran Cudbard-Bell -
Fajar A. Nugraha -
Guillaume Sigui -
Phil Mayers -
siguillaume