Sending accounting packets to more than one server?
Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done? Thanks in advance, -Tim
Tim McNabb <tim@velociter.net> wrote:
Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done?
I have not 'tee'd accounting packets before, but the following should work. Look at the 'decoupled-accounting' and 'robust-proxy-accounting' examples. In your main RADIUS virtual server (the one that talks to your NASes), configure it to write out to *two* different journals. The first one is your 'regular' accounting path that maybe records things in a local SQL database or whatever you like to log to. The second journalled instance you proxy on the packets to this Netsweeper thingy-mcwhatsit. Using the decoupling/journal thing prevents your SQL server (and the appliance) potentially slowing down your accounting acknowledgement replies. Beware though, the size of the journal should not get ever above ~100kB (well for us at least)...if it does, it means FreeRADIUS cannot process your accounting traffic due to some internal error (either out of disk space, bad SQL syntax/error, etc) and the journal will just keep growing until everything comes falling down. The journal growing without me noticing has hit us several times (badness on my part with dodgy SQL I send at my poor postgresql server) so it is on the books either to NAGIOS monitor it or send me an email alert from a cronjob. Cheers -- Alexander Clouter .sigmonster says: Specifications subject to change without notice.
Tim McNabb wrote:
I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I’m working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done?
I have a local module here which blindly sends out an extra copy of an accounting packet to target host(s) you specify, without waiting for any acknowledgement. We use it for teeing off accounting to various packet shapers. Because the module doesn't maintain any state, i.e. wait for acknowledgement or resend if no ack received, it's very lightweight and there are no queues or buffers to overflow. I can probably get permission to release the code if you're interested. Regards, Brian.
On Sat, Mar 12, 2011 at 6:06 PM, Brian Candler <B.Candler@pobox.com> wrote:
I have a local module here which blindly sends out an extra copy of an accounting packet to target host(s) you specify, without waiting for any acknowledgement. We use it for teeing off accounting to various packet shapers.
Because the module doesn't maintain any state, i.e. wait for acknowledgement or resend if no ack received, it's very lightweight and there are no queues or buffers to overflow.
I can probably get permission to release the code if you're interested.
Please do :D It's much better than having to reinvent the wheel. -- Fajar
Brian Candler wrote:
I have a local module here which blindly sends out an extra copy of an accounting packet to target host(s) you specify, without waiting for any acknowledgement.
That's really not a good idea in most cases.
We use it for teeing off accounting to various packet shapers.
Which do... what? Alan DeKok.
On Sun, Mar 13, 2011 at 09:25:23AM +0100, Alan DeKok wrote:
We use it for teeing off accounting to various packet shapers.
Which do... what?
Some sort of class-of-service stuff, I believe, which requires knowing which username is on which (dynamic) IP. There is periodic interim accounting, so if the occasional stop or start packet is lost, eventually it will correct itself. Quite possibly using type=detail would be better. But if I were sending to, say, three remote servers, would I need to write to three separate detail files? A comment in the 'robust-proxy-accounting' example says: # Note that you can have only ONE "listen" section reading # detail files from a particular directory. ... # ... Having two "listen" sections reading detail files # from the same directory WILL cause problems. The packets # may be read by one, the other, or both "listen" sections. I'm having difficulty locating any documentation for "type = detail", and in particular, whether it deletes files after using them. Digging around I found src/main/detail.c and as far as I can see it first renames the detail file, then deletes it when complete. Regards, Brian.
Brian Candler wrote:
Quite possibly using type=detail would be better. But if I were sending to, say, three remote servers, would I need to write to three separate detail files?
Yes.
I'm having difficulty locating any documentation for "type = detail", and in particular, whether it deletes files after using them.
It does. For documentation, patches are welcome. Alan DeKok.
On Sat, Mar 12, 2011 at 11:06:51AM +0000, Brian Candler wrote:
Tim McNabb wrote:
I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I’m working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done?
I have a local module here which blindly sends out an extra copy of an accounting packet to target host(s) you specify, without waiting for any acknowledgement. We use it for teeing off accounting to various packet shapers.
Because the module doesn't maintain any state, i.e. wait for acknowledgement or resend if no ack received, it's very lightweight and there are no queues or buffers to overflow.
I can probably get permission to release the code if you're interested.
I have now secured this permission. The module is available as an attachment to this ticket: https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=151 and also on github: https://github.com/candlerb/freeradius-server/tree/candlerb/packetblast Regards, Brian.
Brian Candler wrote:
and also on github: https://github.com/candlerb/freeradius-server/tree/candlerb/packetblast
There's an API for sending packets. It's not hard to use, and should be preferred to manually encoding and sending the packets. In this case, it may even be *less* code than the current module. If enough people think this is interesting, a modified version can go in. I'm OK with features people find useful, even if the features are weird. It's even better when the features are in a module that doesn't affect anything else. Alan DeKok.
Is it possible to do this with copy-acct-to-home-server? Whit copy-acct-to-home-server I can't get it. Have you get to copy the same set of information from one server to another? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Sending-accounting-packets-to-more-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
tonimanel wrote:
Is it possible to do this with copy-acct-to-home-server? Whit copy-acct-to-home-server I can't get it. Have you get to copy the same set of information from one server to another?
Sending the same question multiple times is rude. Download the latest version, and read doc/ChangeLog. The answer to your question is there. Alan DeKok.
Hi Alan, Sorry very much, but I was desperate. Now I understand how can I do this. Following documentation and re-reading it, I understand that I can use radrelay.conf configuration to do an exactly replica, obviously with a second detail file created and with a reader and a writer configurated. I have opened my eyes! However, I think that there are a lot of answers that cause confusion. Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Sending-accounting-packets-to-more-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (6)
-
Alan DeKok -
Alexander Clouter -
Brian Candler -
Fajar A. Nugraha -
Tim McNabb -
tonimanel