Steel-Belted Radius Carrier 7.2.x Administration and Configuration Guide > Logging and Reporting > Using the Accounting Log File

Using the Accounting Log File

RADIUS accounting events are recorded in the accounting log file. Accounting events include START messages, which indicate the beginning of a connection; STOP messages, which indicate the termination of a connection; and INTERIM messages, which indicate a connection is ongoing.

Accounting log files use comma-delimited, ASCII format, and are intended for import into a spreadsheet or database program. Accounting log files are located in the RADIUS database directory area by default, although you can specify an alternate destination directory in the [Configuration] section of the account.ini file. Accounting log files are named yyyymmdd.ACT, where yyyy is the four-digit year, mm is the month, and dd is the day on which the log file was created.

Accounting log files are kept for the number of days specified in the Settings tab of the Reports panel, and are deleted after that to conserve disk space.

The current log file can be opened while Steel-Belted Radius Carrier is running.

Accounting Log File Format

The first six fields in every accounting log entry are provided by Steel-Belted Radius Carrier for your convenience in reading and sorting the file:

• Date—The date when the event occurred
• Time—The time when the event occurred
• RAS-Client—The name or IP address of the RADIUS client sending the accounting record
• Record-Type—START, STOP, INTERIM, ON, or OFF, the standard RADIUS accounting packet types
• Full-Name—The fully distinguished name of the user, based on the authentication performed by the RADIUS server
• Auth-Type—A number that indicates the class of authentication performed:

0—Native

10—SecurID User

11—SecurID Prefix

12—SecurID Suffix

13—Solaris User

14—Solaris Group

100—Tunnel User

200—External Database

(other)—Proxy

By default, the standard RADIUS attributes follow the Auth-Type identifier. See Standard RADIUS Accounting Attributes691.

You can include vendor-specific attributes if the device sending the accounting packet supports them. For more information, see Vendor-Specific Attributes27.

You can edit the account.ini initialization file to add, remove or reorder the standard RADIUS or vendor-specific attributes that are logged. For information on account.ini, refer to the Steel-Belted Radius Carrier 7.2 Reference Guide.

First Line Headings

The first line of the accounting log file is a file header that lists the attributes that have been enabled for logging in the order in which they are logged. The following example of a first line shows standard RADIUS headings in bold, and vendor-specific headings in regular text:

"Date","Time", "RAS-Client", "Record-Type", "Full-Name", "Auth-Type", 
"User-Name", "NAS-Port", "Acct-Status-Type", "Acct-Delay-Time", 
"Acct-Input-Octets", "Acct-Output-Octets", "Acct-Session-Id", 
"Acct-Authentic","Acct-Session-Time", "Acct-Input-Packets", 
"Acct-Output-Packets", "Acct-Termination-Cause", "Acct-Multi-Session-Id", 
"Acct-Link-Count","Acc-Err-Message", 
"Nautica-Acct-SessionId","Nautica-Acct-Direction", 
"Nautica-Acct-CauseProtocol","Nautica-Acct-CauseSource", 
"Telebit-Accounting-Info","Last-Number-Dialed-Out", 
"Last-Number-Dialed-In-DNIS","Last-Callers-Number-ANI", 
"Channel","Event-Id","Event-Date-Time", "Call-Start-Date-Time","Call-End-Date-Time", 
"Default-DTE-Data-Rate","Initial-Rx-Link-Data-Rate", 
"Final-Rx-Link-Data-Rate","Initial-Tx-Link-Data-Rate", 
"Final-Tx-Link-Data-Rate","Sync-Async-Mode", 
"Originate-Answer-Mode","Modulation-Type", 
"Equalization-Type","Fallback-Enabled","Characters-Sent", 
"Characters-Received","Blocks-Sent","Blocks-Received", 
"Blocks-Resent","Retrains-Requested","Retrains-Granted", 
"Line-Reversals","Number-Of-Characters-Lost", 
"Number-of-Blers","Number-of-Link-Timeouts", 
"Number-of-Fallbacks","Number-of-Upshifts", 
"Number-of-Link-NAKs","Back-Channel-Data-Rate", 
"Simplified-MNP-Levels","Simplified-V42bis-Usage", "PW_VPN_ID"

Comma Placeholders

Steel-Belted Radius Carrier writes accounting events to the accounting log file, If an event recorded in the accounting log file does not have data for every attribute, a comma placeholder marks the empty entry, so that all entries remain correctly aligned with their headings. For example, based on the first line of headings described above, the following is a valid accounting log entry, in which the value of the Acct-Status-Type attribute is 7:

"12/23/1997","12:11:55","RRAS","Accounting-On",

,,,,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

,,,,,,,,,,,,,,,,,,

Standard RADIUS Accounting Attributes

Table 124 lists the standard RADIUS accounting attributes defined in RFC 2866, RADIUS Accounting.

Table 124: Standard RADIUS Accounting Attributes  

Attribute	Description
User-Name	The name of the user as received by the client.
NAS-Port	The port number on the client device.
Acct-Status-Type	A number that indicates the beginning or ending of the user service: 1—Start 2—Stop 3—Interim-Acct 7—Accounting-On 8—Accounting-Off
Acct-Delay-Time	Indicates how many seconds the client has been trying to send this record, which can be subtracted from the time of arrival on the server to find the approximate time of the event generating this request.
Acct-Input-Octets	Number of octets (bytes) received by the port over the connection; present only in STOP records.
Acct-Output-Octets	Number of octets (bytes) sent by the port over the connection; present only in STOP records.
Acct-Session-Id	Identifier used to match START and STOP records in a log file.
Acct-Authentic	Indicates how the user was authenticated by RADIUS, the network access server (local), or another remote authentication protocol: 1—RADIUS 2—Local 3—Remote
Acct-Session-Time	Elapsed time of connection in seconds; present only in STOP records.
Acct-Input-Packets	Number of packets received by the port over the connection; present only in STOP records.
Acct-Output-Packets	Number of packets sent by the port over the connection; present only in STOP records.
Acct-Termination-Cause	Number that indicates how the session was terminated; present only in STOP records: 1—User Request 2—Lost Carrier 3—Lost Service 4—Idle Timeout 5—Session Timeout 6—Admin Reset 7—Admin Reboot 8—Port Error 9—NAS Error 10—NAS Request 11—NAS Reboot 12—Port Unneeded 13—Port Preempted 14—Port Suspended 15—Service Unavailable 16—Callback 17—User Error 18—Host Request
Acct-Multi-Session-Id	Unique accounting identifier to make it easy to link together multiple related sessions in a log file.
Acct-Link-Count	The count of links that are known to have been in a given multi-link session at the time the accounting record is generated.