Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 2 freeradius authentication servers which service around 12k users. Users often enter incorrect credentials and this causes significant strain on the helpdesk. I'd like to write a script to monitor the radius logs for authentication failures (or alternatively the mysql postauth table) and then lookup the customers email address on the database server to be able to send them an email with a link to a password troubleshooting page.

The question is how best to do this? My first thought is to setup rsyslog or something and forward the logs to the web/db server and then have a script running there which tails the logs. I also thought of having something running locally on each radius server which monitors the logs or the mysql postauth table. I can figure out how to implement it but Im not sure of the best strategy. Any advice?

share|improve this question
up vote 2 down vote accepted

You could try using perl in Post-Auth-Type REJECT

post-auth {
  # Login successful: get an address from the IP pool.
  Post-Auth-Type REJECT {
   # Login failed

references Freeradius FAQ, Post-Auth-Type docs, rlm_perl.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.