performace on chainging clients.conf and huntgroup
Alan, I noticed that more IPs I add to clients.conf and huntgroups, more steep performance declines FreeRadius got. Guessing the linked-list. Have we considered other data structures like hashing or btree? -Kevin ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/
Kevin J wrote:
I noticed that more IPs I add to clients.conf and huntgroups, more steep performance declines FreeRadius got. Guessing the linked-list. Have we considered other data structures like hashing or btree?
In the CVS head, clients are in a binary tree. I've successfully tested it with 500K clients. It used 1G of RAM, but it worked... For huntgroups, there currently isn't a fix. The "files" module has moved to a hash, so "rlm_fastusers" shouldn't be necessary. I've tested that with 2M users, and apart from startup time, there is almost no difference between server performance with 1 user or 2M users. Maybe the fixes for "files" could be ported to "huntgroups". Ideally, though, if there are enough huntgroups to be a problem, they should go into a DB. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
I am wondering if there is a tool or way to check the statistics in real time. I need something that can tell me how many users got accepted and rejected so far since Radius started. --------------------------------- Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase.
Hi, i've got freeradius 1.1.6 running on rhel5. when i goto do an ldap auth. i get this Listening on authentication 10.5.5.11:1812 Ready to process requests. rad_recv: Access-Request packet from host 10.5.5.11:32769, id=76, length=59 User-Name = "jvieira" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for jvieira rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to erebus.clarku.edu:389, authentication 0 Segmentation fault ______________________________ dmesg > radiusd[3396]: segfault at 0000000070f2e4c8 rip 00002aaaaefb9380 rsp 00000000409fe650 error 4 any ideas? thanks, Joe
Joe Vieira wrote:
Hi, i've got freeradius 1.1.6 running on rhel5. when i goto do an ldap auth. i get this ... Segmentation fault
See doc/bugs Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
attached is my gdb log, looks like something happens with the ldap_set_option() function. thanks for having a lot Joe -----Original Message----- From: freeradius-users-bounces+jvieira=clarku.edu@lists.freeradius.org on behalf of Alan Dekok Sent: Wed 6/13/2007 3:33 AM To: FreeRadius users mailing list Subject: Re: seg fault Joe Vieira wrote:
Hi, i've got freeradius 1.1.6 running on rhel5. when i goto do an ldap auth. i get this ... Segmentation fault
See doc/bugs Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Found the issue, i added -DLDAP_DEPRECATED to the CFLAGS. Joe Joe Vieira wrote:
Hi, i've got freeradius 1.1.6 running on rhel5. when i goto do an ldap auth. i get this ... Segmentation fault
See doc/bugs Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Kevin J wrote:
I am wondering if there is a tool or way to check the statistics in real time. I need something that can tell me how many users got accepted and rejected so far since Radius started.
Rotate the log whenever you restart radius then: grep -c OK radius.log grep -c Failed radius.log -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Hi,
I am wondering if there is a tool or way to check the statistics in real time. I need something that can tell me how many users got accepted and rejected so far since Radius started.
such a value would be nice as an SNMP'able 64bit counter? alan
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I am wondering if there is a tool or way to check the statistics in real time. I need something that can tell me how many users got accepted and rejected so far since Radius started.
such a value would be nice as an SNMP'able 64bit counter?
If you build the server with SNMP, it's available as a standard 32-bit counter, via the RADIUS MIBs. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
If you build the server with SNMP, it's available as a standard 32-bit counter, via the RADIUS MIBs.
ah, sorry, thought it was 64bit as 32bit COULD wrap....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Does anyone actually maintain dialup admin any more ? Could do with a proper porting to PHP 5... If no ones up for it I'll have a go... got to write some kind of administration tool anyway. -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
A.L.M.Buxey@lboro.ac.uk wrote:
such a value would be nice as an SNMP'able 64bit counter?
Does anyone know of any system that could be used to remotely monitor if a radius server is up? Similar to the uptime testing tools that are available for DNS and http. Chatted to my current monitoring provider and it would probably involve building a custom script for their system. Something along the lines of radtest and then you would add a nasclient line for each testing location and dummy users entry that can be queried by the test location. -- Graham Beneke Apolix Internet Services
Hello all, Does anybody use "monit"? I am using the following in monit.conf --------------- check process radiusd with pidfile /var/run/radiusd.pid group radius start program = "/etc/init.d/radiusd start" stop program = "/etc/init.d/radiusd stop" if failed host 127.0.0.1 port 1645 type udp then restart --------------- But radius.log complaints with Wed Jun 13 09:10:19 2007 : Error: WARNING: Malformed RADIUS packet from host 127.0.0.1: too short (received 1 < minimum 20) Thanks for your help in advance. Irina =============== ----- Original Message ----- From: <A.L.M.Buxey@lboro.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, June 13, 2007 7:49 AM Subject: Re: Statistics tool?
Hi,
Does anyone know of any system that could be used to remotely monitor if a radius server is up?
we use nagios and SNMP - zabbix could also be used to monitor the service in a client/server way.
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Hello all,
Does anybody use "monit"?
I am using the following in monit.conf --------------- check process radiusd with pidfile /var/run/radiusd.pid group radius start program = "/etc/init.d/radiusd start" stop program = "/etc/init.d/radiusd stop" if failed host 127.0.0.1 port 1645 type udp then restart ---------------
But radius.log complaints with Wed Jun 13 09:10:19 2007 : Error: WARNING: Malformed RADIUS packet from host 127.0.0.1: too short (received 1 < minimum 20)
does monit understand the RADIUS protocol? if not, then its sending a single byte to the UDP port 1645 to see if its alive...and FR doesnt like that. alan
I use Nagios and NRPE to monitor my servers. With this you can check any number of things, including the db connections, slow queries, radius, cpu time, memory, any number of ports, etc... Provides a web interface and full reporting, including notifications by email, text message... It works beautifully. Regards, Andrew
Graham Beneke wrote:
Does anyone know of any system that could be used to remotely monitor if a radius server is up?
radclient? Send the server a Status-Server request, and it should respond. See radiusd.conf for more.
Something along the lines of radtest and then you would add a nasclient line for each testing location and dummy users entry that can be queried by the test location.
That's not needed. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan Dekok wrote:
Graham Beneke wrote:
Does anyone know of any system that could be used to remotely monitor if a radius server is up?
radclient? Send the server a Status-Server request, and it should respond. See radiusd.conf for more.
Something along the lines of radtest and then you would add a nasclient line for each testing location and dummy users entry that can be queried by the test location.
That's not needed.
Except I don't think that will test your db connection (if you have one). If you use radclient to do a full auth test, you get a better idea as to the status of the entire service instead of just the daemon. We use a check_radius Nagios script which I believe uses radclient. We also have a script that tails the radius log and pops those entries into another db for our CS ppl to look at and I know it is working correctly even if there is no traffic because I can see the Nagios check entries. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Dennis Skinner wrote:
Alan Dekok wrote:
Graham Beneke wrote:
Does anyone know of any system that could be used to remotely monitor if a radius server is up? radclient? Send the server a Status-Server request, and it should respond. See radiusd.conf for more.
Something along the lines of radtest and then you would add a nasclient line for each testing location and dummy users entry that can be queried by the test location. That's not needed.
Except I don't think that will test your db connection (if you have one). If you use radclient to do a full auth test, you get a better idea as to the status of the entire service instead of just the daemon.
Yes, pretty damn important. It's worth checking the return codes of certain modules like rlm_sql and rlm_ldap and sometimes invoking another module on failure, like a secondary emergency users file with static accounts.. Just in case something goes horribly wrong with your SQL/LDAP server. Here we use RADIUS for authenticating users on the administrative interface of our edge switches, as well as doing port access authentication on the edge ports. During early testing our SQL server died, which meant no one could log into any of the switches on our residential network... Although our switches fail over to local statically configured passwords if they can't reach a radius server.. the RADIUS server was up .. it just wasn't authorising any users :) Actually ... it might be an idea to add another return path which drops the request and sends no reply, just to make the RADIUS server seem dead if any of it's critical dependencies fail. Though I offer no patches ;) -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
Actually ... it might be an idea to add another return path which drops the request and sends no reply, just to make the RADIUS server seem dead if any of it's critical dependencies fail.
I've been discussing similar issues on the IETF RADIUS list. It seems that the RFC's say the server MUST respond to the NAS for Access-Requests. Despite that, many people think it's a good idea to NOT respond in some situations. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan Dekok wrote:
Arran Cudbard-Bell wrote:
Actually ... it might be an idea to add another return path which drops the request and sends no reply, just to make the RADIUS server seem dead if any of it's critical dependencies fail.
I've been discussing similar issues on the IETF RADIUS list. It seems that the RFC's say the server MUST respond to the NAS for Access-Requests. Despite that, many people think it's a good idea to NOT respond in some situations.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Then possibly an agnostic response, though the RFC would have to updated to include the extra packet type... Access-IDontKnowBecauseOurSQLServersBroken -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Dennis Skinner wrote:
Except I don't think that will test your db connection (if you have one). If you use radclient to do a full auth test, you get a better idea as to the status of the entire service instead of just the daemon.
That's why 2.0.0 has the following support for Status-Server: authorize { ... Autz-Type Status-Server { ... } } i.e. that section is run *only* for Status-Server messages. The same thing can be done via Acct-Type, too. Creating fake users for status queries is bad. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
If you meant that I have to restart radius whenever I need the statistics, I will not do that. Is there a way that we can rotate radius.log then? Dennis Skinner <dskinner@bluefrog.com> wrote: Kevin J wrote:
I am wondering if there is a tool or way to check the statistics in real time. I need something that can tell me how many users got accepted and rejected so far since Radius started.
Rotate the log whenever you restart radius then: grep -c OK radius.log grep -c Failed radius.log -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- Yahoo! oneSearch: Finally, mobile search that gives answers, not web links.
Kevin J wrote:
> I need something that can tell me how many users got accepted and > rejected so far since Radius started.
Rotate the log whenever you restart radius then:
grep -c OK radius.log grep -c Failed radius.log
If you meant that I have to restart radius whenever I need the statistics, I will not do that. Is there a way that we can rotate radius.log then?
(Note: I moved your response to preserve the flow of the conversation) The other way around. You asked for a method to count the number of good and bad logins since the service was started, not since the last time you got stats or some other arbitrary time. If you only rotate the log when you restart radius, then the log will have all good and bad logins in it since the last restart (assuming you are not running in debug mode, which outputs to stdout and not to the log). If what you asked for is truly what you want, then my method should work perfectly unless the system is busy enough to grow the log VERY large between restarts. I know radius used to die if certain log files hit the 2GB limit, but I don't know if radius.log was one of them. This can then be remedied by weekly or nightly restarts. Restarts are really quick and you should have a secondary sitting there waiting if it isn't for some reason. Just don't restart both at the same time. If that is not what you want, then please restate your question. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Kevin J wrote:
... Is there a way that we can rotate radius.log then?
$ mv radius.log radius.log.old That's it. The server will automatically re-create "radius.log". There's no need to HUP it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (10)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Alan Dekok
-
Andrew Long -
Arran Cudbard-Bell -
Dennis Skinner -
Graham Beneke -
Irina -
Joe Vieira -
Kevin J