[c-nsp] Incorrect accounting records

[Ben Dale]

This is default behaviour in Steel Belted RADIUS SPE:
 
To disable it, edit yout account.ini file, go to the [Settings] section and change the Carryover option to 0.
 
For more info, check page 145 of the manual (163 of the pdf):
 
http://download.juniper.net/software/aaa_802/public/sbr/docs/SBR54REF.pdf
 
Cheers,
 
Ben

________________________________

From: cisco-nsp-bounces at puck.nether.net on behalf of piestaga
Sent: Thu 21/09/2006 6:59 AM
To: James Wakefield
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Incorrect accounting records



James Wakefield napisa?(a):
> piestaga wrote:
>  
>> Hi,
>>
>> I think it is possible that someone can answer 'not this group' for my
>> question, nevertheless I will try to find any help here.
>> I would like to as if someone had experienced such problem or knows the
>> reason for such case.
>>
>> I had adsl users terminated on the bras (Juniper ERS-310).
>> All sessions are authenticated on radius (former Funk Software SBR/EE)
>>
>> Accounting record file contains not only the records for particular day
>> (accounting record is created once a day and should contain only session
>> that started or finished that day).
>>
>> Problem is that for some reason the log contains also the records of the
>> sessions fow which the 'record start date' is few days or even weeks
>> befor the current date.
>>
>> This happens only on the begining of each record file. I mean that there
>> are few (aprox. less than 20) records with incorrect date and all
>> remaining are correct and nothing wrong happens.
>>
>> This happens every day, there is a real mess on the begining of the new
>> file and after few minutes every thing goes back to normal.
>>
>> Do you have any idea what can be the reason of such 'strange' records ??
>> (of course except the Vendor issue) :-))
>>
>> Thanks
>> Piestaga
>>    
>
> Hi,
>
> As these are ADSL (and as such, "always on") users, is it at all
> possible that what you're seeing are sessions that began a few
> days/weeks ago and stopped on the day of the accounting record file?  If
> so, this is actually correct (though possibly undesirable) behaviour.
> You may wish to consider having the BRAS send regular accounting updates
> for sessions in progress or using flow-based accounting to determine
> usage volumes and RADIUS accounting only to determine what user to
> attribute the flows to.
>
> Am I understanding your issue correctly?  Or is it something else?
>
> Cheers,
>  

Hi,

well what you described in your answer is in fact the regular behaviour. :-)

Problem is that I see on the 'current' log file the START records of the
sessions that were initiated several days/weeks ago.

I also saw that the problem is more complicated.

The begining of new record should start with accounting records (START
or STOP) recorded after 00:00:00 so the correct record should look like
the following example:
08/15/2006 00:00:00 NODE1-ERX1 Stop user_name13 at domain
08/15/2006 00:00:01 NODE4-ERX1 Stop user_name14 at domain
08/15/2006 00:00:01 NODE2-ERX1 Stop user_name15 at domain
08/15/2006 00:00:02 NODE3-ERX1 Stop user_name16 at domain
08/15/2006 00:00:02 NODE5-ERX1 Stop user_name17 at domain
08/15/2006 00:00:07 NODE2-ERX1 Stop user_name18 at domain
08/15/2006 00:00:07 NODE3-ERX1 Stop user_name19 at domain
08/15/2006 00:00:08 NODE4-ERX1 Start user_name20 at domain

What I really see are the following records (in single log file there
are 166 such records) that precede my 'correct' records (presented above) :

08/14/2006 23:59:26 NODE2-ERX1 Start user_name1 at domain
07/28/2006 14:01:33 NODE3-ERX1 Start user_name2 at domain
06/28/2006 03:43:57 NODE5-ERX1 Start user_name3 at domain
08/14/2006 23:57:56 NODE2-ERX1 Start user_name4 at domain
08/14/2006 21:55:00 NODE2-ERX1 Start user_name5 at domain
08/14/2006 23:53:56 NODE3-ERX1 Start user_name7 at domain
06/26/2006 11:25:05 NODE4-ERX1 Start user_name8 at domain
08/14/2006 23:13:06 NODE5-ERX1 Start user_name9 at domain
06/23/2006 05:32:17 NODE2-ERX1 Start user_name10 at domain
08/14/2006 23:52:44 NODE2-ERX1 Start user_name11 at domain
08/14/2006 23:53:38 NODE2-ERX1 Start user_name12 at domain

and then my regular records appear.

08/15/2006 00:00:00 NODE1-ERX1 Stop user_name13 at domain
08/15/2006 00:00:01 NODE4-ERX1 Stop user_name14 at domain
08/15/2006 00:00:01 NODE2-ERX1 Stop user_name15 at domain
08/15/2006 00:00:02 NODE3-ERX1 Stop user_name16 at domain
08/15/2006 00:00:02 NODE5-ERX1 Stop user_name17 at domain
08/15/2006 00:00:07 NODE2-ERX1 Stop user_name18 at domain
08/15/2006 00:00:07 NODE3-ERX1 Stop user_name19 at domain
08/15/2006 00:00:08 NODE4-ERX1 Start user_name20 at domain

This happens every day and it is completely not understandable.
As you can see there are only START records
For me it looks like the log opens always with that 'historical' content
and that irregularity stops when the first 'correct' record is writen down.

any idea ??

Regards
Piestaga

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/