Hello, all Planning an upgrade from 2.2.x to 3.x this summer, but I wanted to start tracking some statistics now so I have evidence of any performance change when we make the move. I've enabled the status server, and can query it with radclient for some good information on auth and proxy traffic. I also enabled the average response time for proxied requests, via the "historic_average_window" statement in home servers. Both of these are working great. Is there a similar capability to monitor statistics (ideally including response time) for FreeRADIUS interactions with an AD back end? Thanks, Steve Lovaas Colorado State University
On Wed, Apr 20, 2016 at 02:48:39PM +0000, Lovaas,Steven wrote:
Planning an upgrade from 2.2.x to 3.x this summer, but I wanted to start tracking some statistics now so I have evidence of any performance change when we make the move.
That's good.
Is there a similar capability to monitor statistics (ideally including response time) for FreeRADIUS interactions with an AD back end?
Your best bet is probably to put a wrapper around calls to ntlm_auth (e.g. as done in https://lists.samba.org/archive/samba/2014-September/184874.html). But this will add extra latency to the call because it's yet another fork. I also seem to remember that if you bump the debug logs up on winbind it will log response time. But the logs grow very fast. Really you probably just want the time the request came in to FreeRADIUS and the time the Accept or Reject was sent back. Unless you change from ntlm_auth to libwbclient then that component of the system shouldn't change so will be the same for v2 and v3. Other monitoring I'd also look at would be pushing your radius logs into something like elasticsearch so you can visualise the number of successful/failed connections (rather than just see the stats). That's pretty easy to do now with the config in https://github.com/FreeRADIUS/freeradius-server/tree/v3.0.x/doc/schemas/logs... Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Apr 20, 2016, at 11:15 , Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Wed, Apr 20, 2016 at 02:48:39PM +0000, Lovaas,Steven wrote:
Planning an upgrade from 2.2.x to 3.x this summer, but I wanted to start tracking some statistics now so I have evidence of any performance change when we make the move.
That's good.
Is there a similar capability to monitor statistics (ideally including response time) for FreeRADIUS interactions with an AD back end?
Your best bet is probably to put a wrapper around calls to ntlm_auth (e.g. as done in https://lists.samba.org/archive/samba/2014-September/184874.html). But this will add extra latency to the call because it's yet another fork.
The latest version of that wrapper can be found at https://github.com/inverse-inc/packetfence/blob/devel/src/ntlm_auth_wrap.c <https://github.com/inverse-inc/packetfence/blob/devel/src/ntlm_auth_wrap.c> It can now send metrics to statsd in addition to (or exclusively) logging. As Matthew says, there is a cost to that. But sometimes it’s worth paying. I am considering patching winbind to send metrics to statsd too. The ability to know how long it takes to authenticate, as well as comparing it to historical data is addictive. Regards, -- Louis Munro lmunro@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
Thanks, Matthew and Louis. Some possibilities to chew on. We are currently rolling out Elasticsearch (an ELK deployment), so that may be a good direction. Steve ________________________________________ From: Freeradius-Users <freeradius-users-bounces+steven.lovaas=colostate.edu@lists.freeradius.org> on behalf of Louis Munro <lmunro@inverse.ca> Sent: Wednesday, April 20, 2016 9:25 AM To: FreeRadius users mailing list Subject: Re: Monitoring connectivity to authentication
On Apr 20, 2016, at 11:15 , Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Wed, Apr 20, 2016 at 02:48:39PM +0000, Lovaas,Steven wrote:
Planning an upgrade from 2.2.x to 3.x this summer, but I wanted to start tracking some statistics now so I have evidence of any performance change when we make the move.
That's good.
Is there a similar capability to monitor statistics (ideally including response time) for FreeRADIUS interactions with an AD back end?
Your best bet is probably to put a wrapper around calls to ntlm_auth (e.g. as done in https://lists.samba.org/archive/samba/2014-September/184874.html). But this will add extra latency to the call because it's yet another fork.
The latest version of that wrapper can be found at https://github.com/inverse-inc/packetfence/blob/devel/src/ntlm_auth_wrap.c <https://github.com/inverse-inc/packetfence/blob/devel/src/ntlm_auth_wrap.c> It can now send metrics to statsd in addition to (or exclusively) logging. As Matthew says, there is a cost to that. But sometimes it’s worth paying. I am considering patching winbind to send metrics to statsd too. The ability to know how long it takes to authenticate, as well as comparing it to historical data is addictive. Regards, -- Louis Munro lmunro@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, in the first instance I would suggest you did some full benchmarking to see how many auths/sec your current 2.x systems can do. in that way, the results will tell you the authentication time and what your server can handle now thus you then have something to compare after the upgrade (if on same hardware and/or same resources). obviously there are some of the new 3.x features you can use - if 3.1.x used then even more features (and you'd be more readily shifted to 3.2.x then too.....) alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Louis Munro -
Lovaas,Steven -
Matthew Newton