Using the Accounting Log File
RADIUS accounting events are recorded in the accounting log file. Accounting events include START messages, which indicate the beginning of a connection; STOP messages, which indicate the termination of a connection; and INTERIM messages, which indicate a connection is ongoing.
Accounting log files use comma-delimited, ASCII format, and are intended for import into a spreadsheet or database program. Accounting log files are located in the RADIUS database directory area by default, although you can specify an alternate destination directory in the [Configuration] section of the account.ini file. Accounting log files are named yyyymmdd.ACT, where yyyy is the four-digit year, mm is the month, and dd is the day on which the log file was created.
Accounting log files are kept for the number of days specified in the Settings page (described in Configuring the Log Retention Period), and are deleted after that to conserve disk space.
An accounting log file is not created when there is no accounting request or activity from the client.
The current log file can be opened while SBR Carrier is running.
By default, SBR Carrier truncates a line in the accounting log when a non-printing character is encountered. You can set the ReplaceUnprintables parameter in the [Logging] section of radius.ini with a printable character which is used instead of non-printing characters when SBR Carrier writes messages to the accounting log file.
Characters of ASCII decimal code 0 through 31 (ASCII hex code 0 through 1F) and 127 through 255 (ASCII hex code 7F through FF) are considered as non-printing characters. For more information about the ReplaceUnprintables parameter, see the SBR Carrier Reference Guide.
Accounting Log File Format
Accounting Log File Format
The first six fields in every accounting log entry are provided by SBR Carrier for your convenience in reading and sorting the file:
Date—The date when the event occurred
Time—The time when the event occurred
RAS-Client—The name or IP address of the RADIUS client sending the accounting record
Record-Type—START, STOP, INTERIM, ON, or OFF, the standard RADIUS accounting packet types
Full-Name—The fully distinguished name of the user, based on the authentication performed by the RADIUS server
Auth-Type—A number that indicates the class of authentication performed:
0—Native13—Solaris User14—Solaris Group100—Tunnel User200—External Database(other)—Proxy
By default, the standard RADIUS attributes follow the Auth-Type identifier. See Standard RADIUS Accounting Attributes.
You can include vendor-specific attributes if the device sending the accounting packet supports them. For more information, see Vendor-Specific Attributes.
You can edit the account.ini initialization file to add, remove or reorder the standard RADIUS or vendor-specific attributes that are logged. For information about account.ini, refer to the SBR Carrier Reference Guide.
First Line Headings
First Line Headings
The first line of the accounting log file is a file header that lists the attributes that have been enabled for logging in the order in which they are logged. The following example of a first line shows standard RADIUS headings in bold, and vendor-specific headings in regular text:
Comma Placeholders
Comma Placeholders
SBR Carrier writes accounting events to the accounting log file, If an event recorded in the accounting log file does not have data for every attribute, a comma placeholder marks the empty entry, so that all entries remain correctly aligned with their headings. For example, based on the first line of headings described above, the following is a valid accounting log entry, in which the value of the Acct-Status-Type attribute is 7:
Standard RADIUS Accounting Attributes
Standard RADIUS Accounting Attributes
Table 123 lists the standard RADIUS accounting attributes defined in RFC 2866, RADIUS Accounting.
Table 123: Standard RADIUS Accounting Attributes
Attribute | Description |
---|---|
User-Name | The name of the user as received by the client. |
NAS-Port | The port number on the client device. |
Acct-Status-Type | A number that indicates the beginning or ending of the user service: 1—Start 2—Stop 3—InterimAcct 7—Accounting-On 8—Accounting-Off |
Acct-Delay-Time | Indicates how many seconds the client has been trying to send this record, which can be subtracted from the time of arrival on the server to find the approximate time of the event generating this request. |
Acct-Input-Octets | Number of octets (bytes) received by the port over the connection; present only in STOP records. |
Acct-Output-Octets | Number of octets (bytes) sent by the port over the connection; present only in STOP records. |
Acct-Session-Id | Identifier used to match START and STOP records in a log file. |
Acct-Authentic | Indicates how the user was authenticated by RADIUS, the network access device (local), or another remote authentication protocol: 1—RADIUS 2—Local 3—Remote |
Acct-Session-Time | Elapsed time of connection in seconds; present only in STOP records. |
Acct-Input-Packets | Number of packets received by the port over the connection; present only in STOP records. |
Acct-Output-Packets | Number of packets sent by the port over the connection; present only in STOP records. |
Acct-Termination-Cause | Number that indicates how the session was terminated; present only in STOP records: 1—User Request 2—Lost Carrier 3—Lost Service 4—Idle Timeout 5—Session Timeout 6—Admin Reset 7—Admin Reboot 8—Port Error 9—NAD Error 10—NAD Request 11—NAD Reboot 12—Port Unneeded 13—Port Preempted 14—Port Suspended 15—Service Unavailable 16—Callback 17—User Error 18—Host Request |
Acct-Multi-Session-Id | Unique accounting identifier to make it easy to link together multiple related sessions in a log file. |
Acct-Link-Count | The count of links that are known to have been in a given multi-link session at the time the accounting record is generated. |