Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have 2 freeradius authentication servers which service around 12k users. Users often enter incorrect credentials and this causes significant strain on the helpdesk. I'd like to write a script to monitor the radius logs for authentication failures (or alternatively the mysql postauth table) and then lookup the customers email address on the database server to be able to send them an email with a link to a password troubleshooting page.

The question is how best to do this? My first thought is to setup rsyslog or something and forward the logs to the web/db server and then have a script running there which tails the logs. I also thought of having something running locally on each radius server which monitors the logs or the mysql postauth table. I can figure out how to implement it but Im not sure of the best strategy. Any advice?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

You could try using perl in Post-Auth-Type REJECT

post-auth {
  # Login successful: get an address from the IP pool.
  ippool
  Post-Auth-Type REJECT {
   # Login failed
   perl
  }
}

references Freeradius FAQ, Post-Auth-Type docs, rlm_perl.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.