Administrator at 18:26, 22 April 2015

2015-04-22T18:26:42Z

← Older revision		Revision as of 18:26, 22 April 2015
Line 19:		Line 19:


	More information on what these fields mean can be found in ~~[http://www.CableFree.com/docs/ros/2.9/guide/aaa_radius~~ CableFree RadioOS Radius client documentation], Supported RADIUS Attributes.		More information on what these fields mean can be found in CableFree RadioOS Radius client documentation, Supported RADIUS Attributes.

	== Sending logs to Syslog ==		== Sending logs to Syslog ==
Line 58:		Line 58:
	* username - username of the user or MAC address, when MAC-authentication used;		* username - username of the user or MAC address, when MAC-authentication used;
	* log type: string describing type of the log. Takes one of the following values: "auth ok", "auth fail", "acct ok", "acct fail". Fail means - the user was not successful to authorize or the accounting log was malicious. To track user session activity, only logs having "auth ok" and "acct ok" must be taken in account.		* log type: string describing type of the log. Takes one of the following values: "auth ok", "auth fail", "acct ok", "acct fail". Fail means - the user was not successful to authorize or the accounting log was malicious. To track user session activity, only logs having "auth ok" and "acct ok" must be taken in account.
	* message - contains message, describing error, in case of failure. can be empty. SysLog messages are limited in size, therefore it could ~~happend~~, that the end of the message has been cut off.		* message - contains message, describing error, in case of failure. can be empty. SysLog messages are limited in size, therefore it could happened, that the end of the message has been cut off.

Administrator: Created page with "Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received. It is configurable per router which logs must b..."

2015-04-22T18:23:10Z

Created page with "Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received. It is configurable per router which logs must b..."

New page

Logs are written when Authorization (auth) or Accounting (acct) requests from [[User Manager/Routers | routers]] are received.

It is configurable per router which logs must be written (See: [[User Manager/QA/How to turn off logging for specific Routers | HOWTO]]).

Log data contains:
* Username. Can differ from those registered in [[User Manager/Users | user]] table;
* User IP;
* Host IP. Router's IP;
* Status;
* Time;
* Description;
* NAS Port;
* NAS Port type;
* NAS Post ID;
* ACCT Session ID;
* Calling station ID.

[[Image: UserManLogDetails.png | Log details]]

More information on what these fields mean can be found in [http://www.CableFree.com/docs/ros/2.9/guide/aaa_radius CableFree RadioOS Radius client documentation], Supported RADIUS Attributes.

== Sending logs to Syslog ==
Starting from version 3.24, support for sending logs to SysLog is added. To enable it:

1) Configure per router, which requests to log: accounting/authorization failure/success (See: [[User Manager/QA/How to turn off logging for specific Routers | HOWTO]]);

2) On the router configure log writing:
<pre>
/system logging add topics=manager,account action=remote
/system logging action set remote target=remote remote=1.2.3.4:514
</pre>, where 1.2.3.4 and 514 is IP address and UDP port of the remote host, which will receive the logs.

3) Configure your remote host to listen on port 514 (any other port can be used, but it MUSt be UDP port and MUST match the one entered in router's system logging action);

4) Test, if logs are successfully received at the remote host:

4.1) Generate some logs by logging in and out using HotSpot/PPP users;

4.2) Check the [[User_Manager/Customer_page#Logs | Log page]]. The logs must appear here. Logs are sent to syslog only if they are logged in the User Manager database;

4.3) Check, if logs are received remotely. If you are running Linux, [http://netcat.sourceforge.net/ nc] can be used:
<pre>
nc -l -u -p 514
</pre> , where 514 is the UDP port used. Could be, that root permissions are required to run listening on a UDP port. Another alternative is [http://www.wireshark.org/ Wireshark] - a multi platform tool for network packet "sniffing". Start a new session and enter
<pre>
udp port 514
</pre>
in the filter field. You should see incoming logs appearing.

=== Syslog message format ===
The logs are in the following format:
<pre>
<user-ip>,<username>,<log-type>,<message>
</pre>, where:

* user-ip - IP of user (NOT the routers IP!): four number in the range 0-255, separated by commas. 0.0.0.0 means "empty address";
* username - username of the user or MAC address, when MAC-authentication used;
* log type: string describing type of the log. Takes one of the following values: "auth ok", "auth fail", "acct ok", "acct fail". Fail means - the user was not successful to authorize or the accounting log was malicious. To track user session activity, only logs having "auth ok" and "acct ok" must be taken in account.
* message - contains message, describing error, in case of failure. can be empty. SysLog messages are limited in size, therefore it could happend, that the end of the message has been cut off.

User Manager/Logs - Revision history

Administrator at 18:26, 22 April 2015

Administrator: Created page with "Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received. It is configurable per router which logs must b..."