FreeRADIUS as accounting relay for syslog
There are some radius servers on my network that can't send their accounting information to syslog servers (can't talk to syslog, or something, don't know the specifics), so I was thinking if it might be possible to use my FreeRADIUS setup as a relay to do this job. The idea is that these servers could send me their accounting information and then use rsyslog to forward the accounting information to another remote syslog server. So far, I have been able to send local accounting to the remote syslog server using rsyslog and a local facility. Is this a good practice? Any particular tips on how to proceed? Thanks!
On Mar 17, 2019, at 5:17 PM, R3DNano <r3dnano@gmail.com> wrote:
There are some radius servers on my network that can't send their accounting information to syslog servers (can't talk to syslog, or something, don't know the specifics), so I was thinking if it might be possible to use my FreeRADIUS setup as a relay to do this job.
Sure.
The idea is that these servers could send me their accounting information and then use rsyslog to forward the accounting information to another remote syslog server. So far, I have been able to send local accounting to the remote syslog server using rsyslog and a local facility. Is this a good practice? Any particular tips on how to proceed?
It should be simple. If the local server is sending data to syslog, all it needs is more accounting data from the other RADIUS servers. Alan DeKok.
It is already listening on the accounting port AFAIK... will do some testing tomorrow but if you mean i don't have to add any specific additional servers, it should be already working... will test and report back in some hours. Cheers. On Sun, Mar 17, 2019 at 10:23 PM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 17, 2019, at 5:17 PM, R3DNano <r3dnano@gmail.com> wrote:
There are some radius servers on my network that can't send their accounting information to syslog servers (can't talk to syslog, or something, don't know the specifics), so I was thinking if it might be possible to use my FreeRADIUS setup as a relay to do this job.
Sure.
The idea is that these servers could send me their accounting information and then use rsyslog to forward the accounting information to another remote syslog server. So far, I have been able to send local accounting to the remote syslog server using rsyslog and a local facility. Is this a good practice? Any particular tips on how to proceed?
It should be simple. If the local server is sending data to syslog, all it needs is more accounting data from the other RADIUS servers.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 18/03/2019, at 10:17 AM, R3DNano <r3dnano@gmail.com> wrote:
There are some radius servers on my network that can't send their accounting information to syslog servers (can't talk to syslog, or something, don't know the specifics), so I was thinking if it might be possible to use my FreeRADIUS setup as a relay to do this job.
The idea is that these servers could send me their accounting information and then use rsyslog to forward the accounting information to another remote syslog server. So far, I have been able to send local accounting to the remote syslog server using rsyslog and a local facility. Is this a good practice? Any particular tips on how to proceed?
Sending accounting data to syslog isn’t a “great” idea for most purposes - but depends on your use case. For some sort of analytics where having every bit of data isn’t important, it’s probably fine. If you’re using it for billing or perhaps IP address usage logging etc. it’s not very good. In terms of tips, depending on your system you’ll need to look for rate limiters. Not really FreeRADIUS specific, but, hey. If you have a systemd system, there’s a rate limiter in systemd. You’ll also likely find one in rsyslog. Deduplication may be an issue for you as well (“last message repeated x times”) depending on what data goes in to your messages. Perhaps you can use a TCP transport, rather than UDP - rsyslog supports that? Depends on your syslog server. You may find your log collection/analytics has a way to do this too - Splunk for example can collect from files, that’s better than normal syslog in a number of ways. -- Nathan Ward
participants (3)
-
Alan DeKok -
Nathan Ward -
R3DNano