FR behavior when DB not available

Anatoliy cphlpd at gmail.com
Mon Jul 17 00:45:40 UTC 2023


Hi Alan ,team, I am testing scenario when main DB is temporary not
available. I set rule in iptables to block all connections to DB. In this
situation freeradius should return Accept with some parameters to NAS.
authorize section is looks like
    sql {
        fail = 1
        notfound = 2
    }
    if ( fail ) {
            update {
                reply:Class = "outage"
                control:Auth-Type := Accept
                reply:Reply-Message := "DB Failed"
                reply:Acct-Interim-Interval := 600
        }
    }

This part works fine, but in traffic dump I see that radius replay with big
delay , some times upto 20-30 seconds. In log a lot messages like
Mon Jul 17 06:12:23 2023 : Error: Unresponsive child for request 288, in
component <core> module
Mon Jul 17 06:12:26 2023 : Error: rlm_sql_unixodbc: SQL down 08S01
[Oracle][ODBC][Ora]ORA-03113: end-of-file on communication channel Process
ID: 151372 Session ID: 97 Serial number: 5095
Mon Jul 17 06:12:34 2023 : Error: rlm_sql_unixodbc: Connection failed

I am trying to tune some parameters for sql connection, but this does not
help.
   pool section
   retry_delay = 120
   lifetime = 30
   max_retries = 2
   uses = 0
in radius.conf
   max_request_time = 5

and kernel (for faster detection that tcp session is broken)
 net.ipv4.tcp_retries2 = 2
 net.ipv4.tcp_keepalive_intvl=5
 net.ipv4.tcp_keepalive_probes=3
 net.ipv4.tcp_keepalive_time=15

Can you recommend which params to change to prevent freeradius stuck on sql
connection to DB ?
Is it possible to prevent FR trying to connect to DB for some time (i think
it is param retry_delay ) for all threads ?


More information about the Freeradius-Users mailing list