Freeradius 3.0.17 and elasticsearch
Hello, any one has configured freeradius logs with elasticsearch? logstash? please could you share configuration steps? Best regards Mettichi Bassem
It's documented so which bits aren't working for you (so we can review/fix documentation) alan On Mon, 14 May 2018, 17:41 Bassem Mettichi, <mettichi@gmail.com> wrote:
Hello,
any one has configured freeradius logs with elasticsearch? logstash?
please could you share configuration steps?
Best regards Mettichi Bassem - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yup got that working , not at work at moment but will send details tomorrow A Sent from my iPhone > On 14 May 2018, at 17:45, Alan Buxey <alan.buxey@gmail.com> wrote: > > It's documented so which bits aren't working for you (so we can review/fix > documentation) > > alan > >> On Mon, 14 May 2018, 17:41 Bassem Mettichi, <mettichi@gmail.com> wrote: >> >> Hello, >> >> any one has configured freeradius logs with elasticsearch? logstash? >> >> please could you share configuration steps? >> >> >> Best regards >> Mettichi Bassem >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello,
i have imported the dashbord on kibana but i have this error message:
Could not locate that visualization (id:
RADIUS-accounting-packets-histogram)
Could not locate that visualization (id: RADIUS-unique-User-Name-by-day)
Could not locate that visualization (id:
RADIUS-table-topN-data-transferred-by-User-Name)
my config file look like this: logstash-radius.conf under
/opt/freeradius/share/logstash
input {
file {
path => "/opt/freeradius/logs/detail"
# Note when testing that logstash will remember where
# it got to and continue from there.
start_position => "beginning"
# Set the type, for below.
type => radiusdetail
codec => multiline {
pattern => "^\t"
negate => false
what => "previous"
}
filter {
if [type] == "radiusdetail" {
# Pull off the timestamp at the start of the
# detail record. Note there may be additional data
# after it that has been added by the local admin,
# so stop at a newline OR a tab.
grok {
match => [ "message",
"^(?<timestamp>[^\n\t]+)[\n\t]" ]
}
# Create the @timestamp field.
date {
match => [ "timestamp", "EEE MMM dd HH:mm:ss yyyy",
"EEE MMM d HH:mm:ss yyyy" ]
}
kv {
field_split => "\n"
source => "message"
trim => "\" "
trimkey => "\t "
}
i have runned radius-mapping as described on the readme file:
./radius-mapping.sh
{"acknowledged":true}[root@buildfr logstash]#
then:
/usr/share/logstash/bin/logstash --path.settings=/etc/logstash -f
logstash-radius.conf
Sending Logstash's logs to /var/log/logstash which is now configured via
log4j2.properties elsaticsearch and freeradius are on the same server,
logstash is enabled and started.
root@buildfr logstash]# systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor
preset: disabled)
Active: active (running) since Mon 2018-05-14 16:57:24 UTC; 18s ago
Main PID: 24637 (java)
Best regards
Mettichi Bassem
2018-05-14 17:45 GMT+01:00 Alan Buxey <alan.buxey@gmail.com>:
> It's documented so which bits aren't working for you (so we can review/fix
> documentation)
>
> alan
>
> On Mon, 14 May 2018, 17:41 Bassem Mettichi, <mettichi@gmail.com> wrote:
>
> > Hello,
> >
> > any one has configured freeradius logs with elasticsearch? logstash?
> >
> > please could you share configuration steps?
> >
> >
> > Best regards
> > Mettichi Bassem
> > -
> > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
On Mon, 2018-05-14 at 17:58 +0100, Bassem Mettichi wrote:
i have imported the dashbord on kibana but i have this error message:
Could not locate that visualization (id: RADIUS-accounting-packets-histogram) Could not locate that visualization (id: RADIUS-unique-User-Name-by- day) Could not locate that visualization (id: RADIUS-table-topN-data-transferred-by-User-Name)
What versions? The examples were created for Kibana 4 (and tested to work on Kibana 5), but it's very possible they don't work on Kibana 6. The Elasticsearch stack tend to move forwards pretty fast, so it wouldn't suprise me if the kibana dashboards don't work as-is any more. IIRC you *might* need to import the kibana config twice, as it might not get dependencies correct the first time (so not be able to find the visualisations for the dashboard, as you've seen).
root@buildfr logstash]# systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2018-05-14 16:57:24 UTC; 18s ago Main PID: 24637 (java)
So, have you checked if any data is actually getting into elasticsearch? Use the _cat and search APIs to have a look to make sure the data is arriving. Or just use the discover page in Kibana. Assuming the data is arriving, building a new dashboard should be pretty straightforward. -- Matthew
Hello, Iam using kibana 6.2 Le lun. 14 mai 2018 18:18, Matthew Newton <mcn@freeradius.org> a écrit :
On Mon, 2018-05-14 at 17:58 +0100, Bassem Mettichi wrote:
i have imported the dashbord on kibana but i have this error message:
Could not locate that visualization (id: RADIUS-accounting-packets-histogram) Could not locate that visualization (id: RADIUS-unique-User-Name-by- day) Could not locate that visualization (id: RADIUS-table-topN-data-transferred-by-User-Name)
What versions?
The examples were created for Kibana 4 (and tested to work on Kibana 5), but it's very possible they don't work on Kibana 6. The Elasticsearch stack tend to move forwards pretty fast, so it wouldn't suprise me if the kibana dashboards don't work as-is any more.
IIRC you *might* need to import the kibana config twice, as it might not get dependencies correct the first time (so not be able to find the visualisations for the dashboard, as you've seen).
root@buildfr logstash]# systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2018-05-14 16:57:24 UTC; 18s ago Main PID: 24637 (java)
So, have you checked if any data is actually getting into elasticsearch? Use the _cat and search APIs to have a look to make sure the data is arriving. Or just use the discover page in Kibana.
Assuming the data is arriving, building a new dashboard should be pretty straightforward.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, 2018-05-14 at 18:24 +0100, Bassem Mettichi wrote:
Hello, Iam using kibana 6.2
OK, the Kibana config in the FR repo hasn't been tested with that, so you're pretty much on your own. Looks like it doesn't work any more. Building your own Kibana dashboard isn't particularly hard, though, and worth learning how to do. The logstash config should all be OK, or require very little tweaking, to work with logstash 6. -- Matthew
Hello, the logstash-radius.conf is not compatible with logstash v 6.2 i have these error messages in logstash logs: [2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trim' for kv [2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trimkey' for kv any idea how to solve this issue? Thanks Mettichi bassem 2018-05-14 18:24 GMT+01:00 Bassem Mettichi <mettichi@gmail.com>:
Hello, Iam using kibana 6.2
Le lun. 14 mai 2018 18:18, Matthew Newton <mcn@freeradius.org> a écrit :
On Mon, 2018-05-14 at 17:58 +0100, Bassem Mettichi wrote:
i have imported the dashbord on kibana but i have this error message:
Could not locate that visualization (id: RADIUS-accounting-packets-histogram) Could not locate that visualization (id: RADIUS-unique-User-Name-by- day) Could not locate that visualization (id: RADIUS-table-topN-data-transferred-by-User-Name)
What versions?
The examples were created for Kibana 4 (and tested to work on Kibana 5), but it's very possible they don't work on Kibana 6. The Elasticsearch stack tend to move forwards pretty fast, so it wouldn't suprise me if the kibana dashboards don't work as-is any more.
IIRC you *might* need to import the kibana config twice, as it might not get dependencies correct the first time (so not be able to find the visualisations for the dashboard, as you've seen).
root@buildfr logstash]# systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2018-05-14 16:57:24 UTC; 18s ago Main PID: 24637 (java)
So, have you checked if any data is actually getting into elasticsearch? Use the _cat and search APIs to have a look to make sure the data is arriving. Or just use the discover page in Kibana.
Assuming the data is arriving, building a new dashboard should be pretty straightforward.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On May 15, 2018, at 9:19 AM, Bassem Mettichi <mettichi@gmail.com> wrote:
Hello,
the logstash-radius.conf is not compatible with logstash v 6.2 i have these error messages in logstash logs:
[2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trim' for kv [2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trimkey' for kv
any idea how to solve this issue?
Read the logstash documentation. This isn't the logstash help list. And don't complain I'm being unhelpful. It should already be *abundantly* clear that no one here knows anything about Logstash 6.2, or how to configure it. Alan DeKok.
On Tue, 2018-05-15 at 09:22 -0400, Alan DeKok wrote:
On May 15, 2018, at 9:19 AM, Bassem Mettichi <mettichi@gmail.com> wrote:
the logstash-radius.conf is not compatible with logstash v 6.2 i have these error messages in logstash logs:
[2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trim' for kv [2018-05-15T11:47:51,141][ERROR][logstash.filters.kv ] Unknown setting 'trimkey' for kv
any idea how to solve this issue?
Read the logstash documentation. This isn't the logstash help list.
Quite. They're provided as examples, and state which versions they've been tested with. And the logstash "kv" documentation says what to do about trim/trimkey. When I'm not so busy I'll update the examples to work with the latest versions. But I don't have time right now. -- Matthew
Hello. We have received a report showing the following error message: Tue May 15 08:25:49 2018 : Error: Failed binding to auth+acct address 192.168.1.36 port 2083 (TLS) bound to server default: Bad file descriptor Tue May 15 08:25:49 2018 : Error: \freeradius-server-3.0.16\etc\raddb/sites-enabled/tls[7]: Error binding to port for 192.168.1.36 port 2083 The IP address shown above is valid. Digging a bit in the code base (listen.c) has led us to the following line: #ifdef HAVE_PTRHEAD_H After fixing that, now we see (radiusd -Xxx): Tue May 15 10:16:50 2018 : Error: \freeradius-server-3.0.16\etc\raddb/sites-enabled/tls[7]: Threading must be enabled for TLS sockets to function properly Tue May 15 10:16:50 2018 : Error: \freeradius-server-3.0.16\etc\raddb/sites-enabled/tls[7]: You probably need to do 'radiusd -fxx -l stdout' for debugging Running 'radiusd -fxx -l stdout' shows: ... ... ... Listening on auth+acct proto tcp address 192.168.1.36 port 2083 (TLS) bound to server default Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 192.168.1.36 port 1821 bound to server example Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on status address 127.0.0.1 port 18121 bound to server status Listening on proxy address * port 54433 Listening on proxy address :: port 54434 Ready to process requests We are not familiar with TLS but the message: 'Threading must be enabled for TLS sockets to function properly' seems misleading. Any help would be appreciated. Thanks in advance.
On May 15, 2018, at 9:23 AM, Sergio NNX <sfhacker@hotmail.com> wrote:
Digging a bit in the code base (listen.c) has led us to the following line:
#ifdef HAVE_PTRHEAD_H
After fixing that, now we see (radiusd -Xxx):
I've pushed a fix, thanks.
Tue May 15 10:16:50 2018 : Error: \freeradius-server-3.0.16\etc\raddb/sites-enabled/tls[7]: Threading must be enabled for TLS sockets to function properly Tue May 15 10:16:50 2018 : Error: \freeradius-server-3.0.16\etc\raddb/sites-enabled/tls[7]: You probably need to do 'radiusd -fxx -l stdout' for debugging ... We are not familiar with TLS but the message:
'Threading must be enabled for TLS sockets to function properly'
seems misleading.
It's not. The server *must* use child thread when using TLS. Alan DeKok.
participants (6)
-
Alan Buxey -
Alan DeKok -
Alex Sharaz -
Bassem Mettichi -
Matthew Newton -
Sergio NNX