FreeRADIUS 1.1.3 syslog and radacct question

[Arran Cudbard-Bell]

On 29 Sep 2011, at 18:51, Tremaine Lea wrote:

> I have a requirement to get successful and failed radius
> authentication logs from FreeRADIUS to a SIEM for audit purposes.  I
> have updated the config to log to syslog, but I need more information
> than is currently appearing.
> 
> Example:
> Sep 29 10:40:56 radiusserver radiusd[13806]: Login incorrect: [azbycx]
> (from client ScreenNets port 0)
> 
> Is there a way to syslog the username, client-ip-addres and
> calling-station-id that appears in radacct?  Alternately, is there a
> way to send radacct to syslog instead of the file system?  In my ideal
> world, all of the information currently recorded for radacct would be
> logged to the SIEM but I'm not sure how to best achieve that.
> 
> I've been through the documentation and just am not finding an obvious
> way to change what information is sent to syslog.
> 
> Any help/suggestions would be much appreciated.

Upgrade.

Use the rlm_linelog module :)

1.1.3 was released five years ago, i'm not sure what you're wanting is possible in a 1.* version and even if it was i'm not sure anyone would remember how to configure it...

Arran Cudbard-Bell
a.cudbardb at freeradius.org

Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !