Table of Contents

Debugging for FreeRADIUS

Enabling debug mode requires restarting RADIUS.

Enabling debug mode

  1. Enable the FreeRADIUS control-socket: 
    ln -s /etc/raddb/sites-available/control-socket /etc/raddb/sites-enabled/

    This module allows the RAdmin administration tool to work.

    1. Configure RAdmin write permissions in /etc/raddb/sites-available/control-socket: 
      mode = rw

      Possible values:

      • ro = read-only access (default)
      • rw = read and write access
    2. Verify that the module is added to the main config: 
      ls -la /etc/raddb/sites-enabled/
  2. Restart radiusd: 
    systemctl restart radiusd
Restarting does not terminate subscriber sessions (neither auth nor acct), but during the restart Proxy packet loss may occur from SSG to RADIUS, for example several Interim-Update or Access-Request packets. They will be resent after the restart.

Working with RAdmin

  1. Open RAdmin: 
    radmin
    1. Logging is written to the directory defined in /etc/raddb/radiusd.conf, by default it is radius.log
    2. Enable debug mode 
      debug level 4

      The logging verbosity can be set from 0 (disable logging) to 4 (debug mode, similar to radiusd -X).
      :!: Important! Even with logging level 1, debug mode generates a large number of logs, so it is not recommended to keep logging enabled for a long time to avoid filling system storage.

    3. Select a file for writing logs: 
      debug file [filename]

      :!: Commands must be entered sequentially; they cannot be used simultaneously as in: debug level 3 debug file [filename]

  2. If an error occurs after restarting radiusd or when attempting to connect to RAdmin — check whether the socket /var/run/radiusd/radiusd.sock exists and what permissions are assigned to it.
    If there are no access permissions (default is radiusd) — change the gid and uid parameters to "root" in /etc/raddb/sites-available/control-socket.
    • uid — the user name allowed to connect to the control socket.
    • gid — the group name allowed to connect to the control socket.