Re: (ASCEND) Radius Log file analysis

Chris Shenton (cshenton@it.hq.nasa.gov)
Mon, 03 Feb 1997 12:06:27 -0500

On Sun, 2 Feb 1997 10:33:45 +1100 (EST)
skeeve@skeeve.net (Skeeve Stevens) wrote:

skeeve> I have a client who wants to be able to look up the
skeeve> hours that each dialup user used each month.... not an
skeeve> unreasonable request ;)
skeeve>
skeeve> He also wants users to be able to go to a webpage and
skeeve> be able to see how many hours they have used so far for the
skeeve> current month.... also not an unreasonable request.
skeeve>
skeeve> I am not sure how to do the following:
skeeve>
skeeve> o scan the logfile for one users transactions for a single 'month'
skeeve>
skeeve> o split the logfile into seperate months
skeeve>
skeeve> o also what would happen if a record goes over
skeeve> a 2 month period? ie they log on at 11pm on the 30th, log off
skeeve> next month
skeeve>
skeeve> The interface for users to lookup their own times is
skeeve> easy.... the cgi to count the number of ours for the current
skeeve> month, maybe also previous months... it would be good to let
skeeve> them choose.... also an overview of how much every month since
skeeve> theyve joined...
skeeve>
skeeve> Does anyone have any scripts, perl or C or anything which can
skeeve> do any or some of the above? I would be most
skeeve> appreciative... thanx

You can try one I've written. It was originally written to handle
Livingston RADIUS-pre-2.0 logs, but I then spent most of my time
extending it to do Ascend logs. It will do a variety of reports, like
all login/out events, cumulative summaries, port usage, etc. The
code's at

http://www.it.hq.nasa.gov/~cshenton/radacct

Unlike your request, it wasn't really designed to do real-time
accounting, but to be run at the end of the month or week. You might
be able to run it once a day or something, or at least steal the
relevant code chunks. You could then dump that to HTML or some such.

W.R.T. worrying about going over midnight, or a month boundary: you
can't do much. My code tries to link begin-events to end-events by the
event ID. All that really matters though is the end-event, which lists
the time connected; this is the approach most of the scripts I've seen
use.

If you have a lot of users, the scripts to process the logs will take
a fair amount of time. Therefore, it's not reasonable to try and run
such scripts on demand, via a CGI. You need to process offline.

I believe some vendors have products which dump results into a real
database, which then might be queried in real-time. That wasn't a
requirement for my task.