Remotely monitoring server activity

[Jorge Pereira]

Btw, I don't know about your business. But, send to an ElasticSearch
could be a great way to do analytics. Think about it.
--
Jorge Pereira

On Wed, Feb 6, 2019 at 2:45 PM Niels Tomey <niels at ixs.ph> wrote:
>
> We're using graylog at work to interpret syslog messages. You can create
> alerts if for example more than x login attempts failed within a certain
> time frame and then get notified about it. You just need to define a grok
> pattern for it.
>
> You could also use process monitoring through SNMP to get an alert when
> something happens to the radius process itself.
>
> Regards,
>
> Niels
>
> On Thu, Feb 7, 2019, 00:35 Jorge Pereira <jpereiran at gmail.com wrote:
>
> > On Wed, Feb 6, 2019 at 12:45 PM R3DNano <r3dnano at gmail.com> wrote:
> > >
> > > I'm trying to manage the global freeradius status from a remote location.
> > > The files under /var/log/radius/radacct are pretty detailed and have a
> > > lot of information about what is going on with the freeradius server.
> > > However, searching the old mailing list archives, I see there's a
> > > particular thread of someone asking how to send the radacct logs to a
> > > remote syslog being not a recommended practice.
> > >
> >
> > I did something similar using the syslog-ng with pattern-db
> >
> > https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.19/administration-guide/72#TOPIC-1094740
> >
> > > What's a practical way of having this information for further analysis
> > > outside of the freeradius server? Send it to an SQL database somehow
> > > perhaps?
> > >
> > > Also, about the logs sent to syslog (for further forwarding to a
> > > remote syslog server) - is there a way to customize what's being sent
> > > on those messages?
> > >
> > > Thanks.
> > > -
> > > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> > -
> > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html