Download This Guide
authlog.ini File
The authlog.ini initialization file contains information that controls how RADIUS authentication request attributes are logged in the comma-delimited yyyymmdd.authlog file.
[Alias/name] Sections
You can create one or more [Alias/name] sections in authlog.ini (Table 39) to associate attributes of different names, but identical meaning. For example, one network access server vendor might call an attribute Auth-Connect-Type and another might call it AuthConn-Typ, yet the two attributes would both map to Auth-Conn-Type.
Each [Alias/name] section permits you to map one RADIUS authentication request attribute that is already being logged by Steel-Belted Radius Carrier to any number of other attributes. You can provide as many [Alias/name] sections as you want, using this syntax for each section:
[Alias/name] VendorSpecificAttribute= VendorSpecificAttribute=
Table 39: authlog.ini [Alias/name] Syntax
Parameter | Function |
|---|---|
name | The preferred attribute name. The name attribute must be one that you are currently logging to a column in the Steel-Belted Radius Carrier authentication request log file (.authlog). Therefore, it must be listed in the [Attributes] section of authlog.ini. |
VendorSpecificAttribute | Each entry is given on one line. An equal sign (=) must immediately follow each VSA name, without any intervening space. Improperly formatted entries are considered invalid and are ignored. |
Each VendorSpecificAttribute in the list is logged to the name column in the authentication request log file. Because you are listing these attributes in an [Alias/name] section, make sure they are not listed in the [Attributes] section or they are logged to their own columns as well as to the name column.
All of the attribute names that you reference in an [Alias/name] section must be defined in a dictionary file that is already installed on the Steel-Belted Radius Carrier server. This includes name and each VendorSpecificAttribute entry.
In the following example, the standard RADIUS attribute Auth-Conn-Type is mapped to the vendor-specific attributes AuthConnect-Type and AuthConn-Typ. Values encountered for all three attributes are logged in the AuthOctetPackets column in the authentication request log file:
[Alias/Auth-Conn-Type] Auth-Conn-Typ= Auth-Connect-Type=
[Attributes] Section
The [Attributes] section of authlog.ini lists all the attributes logged in the authentication request log file. These include attributes in Access-Request messages received from the network access server (NAS). Attributes that Steel-Belted Radius Carrier returns to the NAS are not logged in this file. When you install Steel-Belted Radius Carrier, the authlog.ini file is set up so that all standard RADIUS attributes and all supported vendor authentication attributes are listed.
You can configure what is logged to the authentication request log file by rearranging the order of attributes in the [Attributes] section. You can delete or comment out attributes you do not want or that do not apply to your equipment. This lets you design the content and column order of any spreadsheets that you plan to create based upon the authentication request log file.
The syntax of the [Attributes] section is:
[Attributes] AttributeName= AttributeName=
For example:
[Attributes] User-Name= NAS-IP-Address= NAS-Port= Service-Type= Framed-Protocol= Framed-IP-Address= Framed-IP-Netmask= Framed-Compression=
The [Attributes] section lists one AttributeName on each line. You must ensure that an equal sign (=) immediately follows each AttributeName, with no spaces in between. Improperly formatted entries are considered invalid and are ignored.
Each AttributeName in the [Attributes] section must be defined in a standard RADIUS dictionary file (.dct file), a subattribute dictionary file (.jdict file), or vendor-specific dictionary file (.dct) installed on the Steel-Belted Radius Carrier server.
 | Note: The first five attributes in each authentication log file entry (Date, Time, RASClient, FullName, and ACC/REJ) are always enabled, and cannot be reordered or deleted. Therefore, these attributes do not appear in the authlog.ini file [Attributes] section. |
[Configuration] Section
The [Configuration] section of authlog.ini specifies the location of the yyymmdd.authlog file.
Table 40: authlog.ini [Configuration] Syntax
Parameter | Function |
|---|---|
LogDir | Specifies the destination directory on the local host where yyyymmdd.authlog files are stored. Default value is the directory where Steel-Belted Radius Carrier is installed. Note: With directed realms, you can maintain multiple authentication log locations. |
[Syslog] Section
The [Syslog] section of the authlog.ini file enables authentication request information to be written to the system log file. Compatible applications (such as rsyslog) can be used to forward these system log messages to a remote server or database. The format of the system log message is the same as that of the authentication log message.
Parameter | Function |
|---|---|
Enable | Enables authentication request information to be written to the system log file. If set to 1, this setting enables writing of authentication requests to the system log file. If set to 0, this setting disables writing of authentication requests to the system log file. The default value is 0. Note: This setting is independent of the Enable setting in the [Configure] section of the authentication log. |
Facility | This parameter sets the system log facility. The default value is Daemon, but could be set to Local[X], where X = 0–7. |
Severity | This parameter sets the severity of the system log message. The value could be Info or Notice. The default value is Info. |
Following are some configuration examples of syslog.conf and rsyslog.conf files:
Example 1—To write all authlog messages to /var/adm/messages using the LOCAL3 facility and LOG_INFO severity:
- Configure the authlog.ini file
as:
[Syslog] Enable = 1 Facility = local3 Severity = Info
- Add the following statement in the /etc/syslog.conf file:
*.err;kern.debug;daemon.notice;mail.crit;local3.info /var/adm/messages
- Run the following command:
kill -HUP `pgrep syslogd`
- Restart the sbrd process.
./sbrd restart
- Authlog messages are written to the system log (/var/adm/messages).
| Note: In Linux, you need to use the rsyslog.conf file instead of syslog.conf. By default, system logs are stored under /var/log/messages. |
Example 2—To write all authlog messages to a SQL database (Linux configuration example):
- Configure the authlog.ini file
in the local server as:
[Syslog] Enable = 1 Facility = daemon Severity = Info
- Restart the sbrd process.
./sbrd restart
- Update the /etc/rsyslog.conf file in the local server as:
#### MODULES #### $Modload ommysql #provide Mysql support $ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command) $ModLoad imklog.so # provides kernel logging support (previously done by rklogd) $ModLoad immark.so # provides --MARK-- message capability #Provides TCP system log reception $ModLoad imtcp.so $InputTCPServerRun 514 $template test,"insert into rsyslog5(host,pid,facility,priority,datetime,msg) values('%hostname%',
'%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%','%syslogfacility%','%syslogpriority%',
'%timereported:::date-mysql%','%msg%')",SQL *.* >sbr-lin1.englab.juniper.net,test,testuser,testpassword;testNote: The statement *.* >sbr-lin1.englab.juniper.net,test,testuser,testpassword;test is in the format *.* >dbhost,dbname,dbuser,dbpassword;dbtemplate.
- Restart the rsyslog service.
Service rsyslog restart
- Authlog messages are written to the SQL DB of the SQL server.
Example 3—To write all authlog messages to a remote server (Linux configuration example):
- Configure the authlog.ini file
in the local server as:
[Syslog] Enable = 1 Facility = daemon Severity = Info
- Restart the sbrd process.
./sbrd restart
- Update the /etc/rsyslog.conf file in the local server as:
*.* @@192.168.1.1:514
Note: Here, 192.168.1.1:514 is a remote SBR server.
- Restart the rsyslog service.
Service rsyslog restart
- Update the /etc/rsyslog.conf file in the remote server as:
# Provides TCP system log reception $ModLoad imtcp.so $InputTCPServerRun 514 *.info;mail.none;authpriv.none;cron.none /var/log/messages
- Restart the rsyslog service.
Service rsyslog restart
- Authlog messages are written to the remote server’s system log (/var/log/messages).
[Settings] Section
Steel-Belted Radius Carrier writes all authentication request data to the current authentication request log file (yyyymmdd.authlog) until that log file is closed. When Steel-Belted Radius Carrier closes an authentication request log file, it immediately opens a new one and begins writing authentication request data to it.
You can configure how often this rollover of the authentication request log file occurs.
The naming conventions of the authentication request log files support the fact that Steel-Belted Radius Carrier can create more than one file per day. In the examples in Table 41, y =year digit, m =month digit, d =day digit, and h =hour digit. The extra sequence number _nnnnn starts at _00000 each day.
Table 41: Authentication Log Rollover
File Generation Method | File Naming Convention |
|---|---|
Default (24 hours) | yyyymmdd.authlog |
Non-24-hour rollover | yyyymmdd_hhmm.authlog |
Rollover due to size | yyyymmdd_nnnnn.authlog |
Rollover due to size or startup when non24hour time in effect | yyyymmdd_hhmm_nnnnn.authlog |
The [Settings] section of authlog.ini in Table 42 controls which entries are written to the authentication request log file, and ensure the compatibility of these entries with a variety of database systems. These rollover settings can be present in the [Settings] section.
Table 42: authlog.ini [Settings] Syntax
Parameter | Function |
|---|---|
Enable |
Set Enable to 1 for Authentication servers. For efficiency, set Enable to 0 for nonauthentication servers. Default value is 0. |
LogAssignedIpAddress |
The default value is 0 (Disabled). Here is a sample output displaying the header and log message Header: "Date","Time","RAS-Client","Full-Name","Acc/Rej","User-Name", Log Message: "11/11/2010","01:42:51","<ANY>”,"ROOT","ACCEPT","ROOT", "10.206.144.123","1975",,,,,,,,,"t1.internet",,,,,"2",,,"10.206.144.1" "11/11/2010","01:43:06","<ANY>”,"ROOT","ACCEPT","ROOT", |
LogFilePermissions | Specifies the owner and access permission setting for the authorization request log (yyyymmdd.authlog) file. Enter a value for the LogFilePermissions setting in owner:group permissions format, where:
|
LineSize | Specifies the maximum number of characters in a line in the authentication request log. You can enter a number in the range 1024–32768. Default value is 4096. Note: Logging will fail if this value is exceeded. |
MaxSize |
Default value is 0. |
QuoteBinary |
Set this value according to the format expected by the application that processes the authentication request log entries. Default value is 1. |
QuoteInteger |
Set this value according to the format expected by the application that processes the authentication request log entries. Default value is 1. |
QuoteIPAddress |
Set this value according to the format expected by the application that processes the authentication request log entries. Default value is 1. |
QuoteText |
Set this value according to the format expected by the application that processes the authentication request log entries. Default value is 1. |
QuoteTime |
Set this value according to the format expected by the application that processes the authentication request log entries. Default value is 1. |
RollOver | Specifies how often the current authentication request log file is closed and a new file opened (a rollover), up to one rollover per minute.
Default value is 0. |
RollOverOnStartup |
Default value is 0. |
Titles |
Default value is 1. |
UTC |
Default value is 0. |
