parsing detail files myself
As a follow on the my requirement of reading the detail file and updating them into MSSQL database, I have written a program to parse the content of the file, which is produced by ***ONE*** single Cisco box sending data to free radius 1.04, and this is what I noticed, I need someone to tell me if this is an expected behaviour or somewhere there is something wrong :- My observations :- 1. The number attributes in a records ( ie the number of lines in a "record" ) is not consistent. I have skipped those Cisco-AVPair in the files, and this is the stats :- acount=25, value=0 acount=26, value=0 acount=27, value=0 acount=28, value=0 acount=29, value=14 acount=30, value=16 acount=31, value=7290 acount=32, value=6724 acount=33, value=0 acount=34, value=0 acount=35, value=0 In other words, in my detail file, there are 14 records which have 29 attributes, 16 records with 30 attributes, 7290 records which have 31 attributes and 6724 records with 32 attributes. Question is why don't they have the same number of attributes ? 2. Not only that, the occurances of the attributes are not consistent either :- attrib=Acct-Authentic, occurance=14043 attrib=Acct-Delay-Time, occurance=14043 attrib=Acct-Input-Octets, occurance=14043 attrib=Acct-Input-Packets, occurance=14043 attrib=Acct-Output-Octets, occurance=14043 attrib=Acct-Output-Packets, occurance=14043 attrib=Acct-Session-Time, occurance=14043 attrib=Acct-Status-Type, occurance=14043 attrib=Acct-Unique-Session-Id, occurance=14055 attrib=Called-Station-Id, occurance=14043 attrib=Calling-Station-Id, occurance=14013 attrib=Cisco-NAS-Port, occurance=6194 attrib=Client-IP-Address, occurance=14045 attrib=NAS-IP-Address, occurance=14043 attrib=NAS-Port, occurance=6194 attrib=NAS-Port-Type, occurance=6194 attrib=Service-Type, occurance=14043 attrib=Timestamp, occurance=21349 attrib=User-Name, occurance=14013 attrib=gw-final-xlated-cdn, occurance=545 attrib=gw-rxd-cdn, occurance=14043 attrib=h323-call-origin, occurance=14043 attrib=h323-call-type, occurance=14043 attrib=h323-conf-id, occurance=14043 attrib=h323-connect-time, occurance=14043 attrib=h323-disconnect-cause, occurance=14043 attrib=h323-disconnect-time, occurance=14043 attrib=h323-gw-id, occurance=14043 attrib=h323-incoming-conf-id, occurance=14043 attrib=h323-remote-address, occurance=7849 attrib=h323-setup-time, occurance=14043 attrib=h323-voice-quality, occurance=14043 attrib=session-protocol, occurance=7849 attrib=subscriber, occurance=14043 Take for example, why Cisco NAS port has such low occurances in the detail file ? Similarly why h323-remote-address has such a low occurances ? Is it a Cisco thingy or free radius did not parse what Cisco sent correctly ? Appreciate any help or comments.
On Tuesday 22 November 2005 20:59, Ming-Ching Tiew wrote:
My observations :-
1. The number attributes in a records ( ie the number of lines in a "record" ) is not consistent. I have skipped those Cisco-AVPair in the files, and this is the stats :-
Why skip anything? It will only confuse you and anyone else you show it to.
acount=25, value=0 acount=26, value=0 acount=27, value=0 acount=28, value=0 acount=29, value=14 acount=30, value=16 acount=31, value=7290 acount=32, value=6724 acount=33, value=0 acount=34, value=0 acount=35, value=0
In other words, in my detail file, there are 14 records which have 29 attributes, 16 records with 30 attributes, 7290 records which have 31 attributes and 6724 records with 32 attributes. Question is why don't they have the same number of attributes ?
Why should they?
2. Not only that, the occurances of the attributes are not consistent either :-
Take for example, why Cisco NAS port has such low occurances in the detail file ? Similarly why h323-remote-address has such a low occurances ?
Is it a Cisco thingy or free radius did not parse what Cisco sent correctly ?
FreeRADIUS will log what it is sent and what you tell it to. You have 7849 records that have session-protocol and h323-remote-address in common. There are 6194 records with NAS-Port, NAS-Port-Type and Cisco-NAS-Port. 7849+6194 = 14043. The attributes that have that count (14043) are common to both types of records. There are 30 records that have no User-Name ( 14 + 16 = your shortest records?). I don't know why you have so many timestamps. If you are going to parse the detail files you should examine them with your eyes first to see what is being sent. How are Start records different from Stop? What type of record has gw-final-xlated-cdn? Then you will know that Apples + Oranges <> Brie Zoltan Ori
participants (2)
-
Ming-Ching Tiew -
Zoltan A. Ori