Sending accounting packets to more than one server?

[Alexander Clouter]

Tim McNabb <tim at velociter.net> wrote:
> 
> Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is 
> possible to forward accounting packets to another server while also 
> keeping the packets on the local machine. I'm working on integrating a 
> Netsweeper appliance and the company is saying that I need to forward 
> accounting packets to the appliance in order for it to set policies 
> correctly. Has anyone ever done this or would be willing to forward 
> some good documentation on how this can be done?
> 
I have not 'tee'd accounting packets before, but the following should 
work.  Look at the 'decoupled-accounting' and 'robust-proxy-accounting' 
examples.

In your main RADIUS virtual server (the one that talks to your NASes), 
configure it to write out to *two* different journals.  The first one is 
your 'regular' accounting path that maybe records things in a local SQL 
database or whatever you like to log to.  The second journalled instance 
you proxy on the packets to this Netsweeper thingy-mcwhatsit.

Using the decoupling/journal thing prevents your SQL server (and the 
appliance) potentially slowing down your accounting acknowledgement 
replies.  Beware though, the size of the journal should not get ever 
above ~100kB (well for us at least)...if it does, it means FreeRADIUS 
cannot process your accounting traffic due to some internal error 
(either out of disk space, bad SQL syntax/error, etc) and the journal 
will just keep growing until everything comes falling down.

The journal growing without me noticing has hit us several times 
(badness on my part with dodgy SQL I send at my poor postgresql server) 
so it is on the books either to NAGIOS monitor it or send me an email 
alert from a cronjob.

Cheers

-- 
Alexander Clouter
.sigmonster says: Specifications subject to change without notice.