parsing detail files myself

[Zoltan A. Ori]

On Tuesday 22 November 2005 20:59, Ming-Ching Tiew wrote:

> My observations :-
>
> 1. The number attributes in a records ( ie the number of lines in a
> "record" ) is not consistent. I have skipped those Cisco-AVPair in the
> files, and this is the stats :-

Why skip anything? It will only confuse you and anyone else you show it to.

>
>  acount=25, value=0
>  acount=26, value=0
>  acount=27, value=0
>  acount=28, value=0
>  acount=29, value=14
>  acount=30, value=16
>  acount=31, value=7290
>  acount=32, value=6724
>  acount=33, value=0
>  acount=34, value=0
>  acount=35, value=0
>
> In other words, in my detail file, there are 14 records which have 29
> attributes, 16 records with 30 attributes, 7290 records which have 31
> attributes and 6724 records with 32 attributes. Question is why don't
> they have the same number of attributes ?


Why should they? 

>
> 2. Not only that, the occurances of the attributes are not consistent
>     either :-
>

> Take for example, why Cisco NAS port has such low occurances
> in the detail file ? Similarly why h323-remote-address has such
> a low occurances ?
>
> Is it a Cisco thingy or  free radius did not parse what Cisco sent
> correctly ?
>

FreeRADIUS will log what it is sent and what you tell it to.
 
You have 7849 records that have session-protocol and h323-remote-address in 
common. There are 6194 records with NAS-Port, NAS-Port-Type and 
Cisco-NAS-Port. 7849+6194 = 14043. The attributes that have that count 
(14043) are common to both types of records.

There are 30 records that have no User-Name ( 14 + 16 = your shortest 
records?).

I don't know why you have so many timestamps. 

If you are going to parse the detail files you should examine them with your 
eyes first to see what is being sent. How are Start records different from 
Stop? What type of record has gw-final-xlated-cdn? Then you will know that  
Apples + Oranges <> Brie

Zoltan Ori