[RADIATOR] logging (radiator and authlog) and accounting to ElasticSearch

[Alexander Hartmaier]

Hi Klara,
thanks for the script!

I expected that Radiator executes the configured program in a forked
process once and expects it to read from STDIN in an event loop.
Seems the program is executed for every log message.

What are your experiences with scaling and performance?

@Radiator guys: are you interessted in supporting Message::Passing,
Log::Log4perl or Log::Any?
They support a lot of outputs which would be a great feature addition!

On 2013-09-19 19:56, Klara Mall wrote:
> Hi Alexander,
>
> On 09/19/2013 04:57 PM, Alexander Hartmaier wrote:
>> Since quite some time I'm looking for a way to customize the accounting
>> log file format but the problem I'm having with it is that there seems
>> to be no way to log all key/value pairs contained in the accounting
>> packet without specifying each name.
>> The default format is nice to read but hard to search with e.g. ack or grep.
>> I've read that using pipe followed by a program as AcctLogFileName works
>> but passing data serialized one log per line to it would also be easier
>> for the program to parse the log and pass it on (e.g. JSON serialized).
> We ran into the same problem and wrote a perl script which we pipe the
> Accounting Log to. It's attached.
>
> radiator config:
> AcctLogFileName | /usr/local/bin/radacclog.pl
>
> Regards
> Klara
>

--
Best regards, Alexander Hartmaier

T-Systems Austria GesmbH
TSS Security Services
Network Security & Monitoring Engineer

phone: +43(0)57057-4320
fax: +43(0)57057-954320



*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien
Handelsgericht Wien, FN 79340b
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
Notice: This e-mail contains information that is confidential and may be privileged.
If you are not the intended recipient, please notify the sender and then
delete this e-mail immediately.
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*