[c-nsp] Incorrect accounting records

[piestaga]

Ben Dale napisa?(a):
> This is default behaviour in Steel Belted RADIUS SPE:
>  
> To disable it, edit yout account.ini file, go to the [Settings] section and change the Carryover option to 0.
>  
> For more info, check page 145 of the manual (163 of the pdf):
>  
> http://download.juniper.net/software/aaa_802/public/sbr/docs/SBR54REF.pdf
>  
> Cheers,
>  
> Ben
>
> ________________________________
>
> From: cisco-nsp-bounces at puck.nether.net on behalf of piestaga
> Sent: Thu 21/09/2006 6:59 AM
> To: James Wakefield
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Incorrect accounting records
>
>
>
> James Wakefield napisa?(a):
>   
>> piestaga wrote:
>>  
>>     
>>> Hi,
>>>
>>> I think it is possible that someone can answer 'not this group' for my
>>> question, nevertheless I will try to find any help here.
>>> I would like to as if someone had experienced such problem or knows the
>>> reason for such case.
>>>
>>> I had adsl users terminated on the bras (Juniper ERS-310).
>>> All sessions are authenticated on radius (former Funk Software SBR/EE)
>>>
>>> Accounting record file contains not only the records for particular day
>>> (accounting record is created once a day and should contain only session
>>> that started or finished that day).
>>>
>>> Problem is that for some reason the log contains also the records of the
>>> sessions fow which the 'record start date' is few days or even weeks
>>> befor the current date.
>>>
>>> This happens only on the begining of each record file. I mean that there
>>> are few (aprox. less than 20) records with incorrect date and all
>>> remaining are correct and nothing wrong happens.
>>>
>>> This happens every day, there is a real mess on the begining of the new
>>> file and after few minutes every thing goes back to normal.
>>>
>>> Do you have any idea what can be the reason of such 'strange' records ??
>>> (of course except the Vendor issue) :-))
>>>
>>> Thanks
>>> Piestaga
>>>    
>>>       
>> Hi,
>>
>> As these are ADSL (and as such, "always on") users, is it at all
>> possible that what you're seeing are sessions that began a few
>> days/weeks ago and stopped on the day of the accounting record file?  If
>> so, this is actually correct (though possibly undesirable) behaviour.
>> You may wish to consider having the BRAS send regular accounting updates
>> for sessions in progress or using flow-based accounting to determine
>> usage volumes and RADIUS accounting only to determine what user to
>> attribute the flows to.
>>
>> Am I understanding your issue correctly?  Or is it something else?
>>
>> Cheers,
>>  
>>     
>
> Hi,
>
> well what you described in your answer is in fact the regular behaviour. :-)
>
> Problem is that I see on the 'current' log file the START records of the
> sessions that were initiated several days/weeks ago.
>
> I also saw that the problem is more complicated.
>
> The begining of new record should start with accounting records (START
> or STOP) recorded after 00:00:00 so the correct record should look like
> the following example:
> 08/15/2006 00:00:00 NODE1-ERX1 Stop user_name13 at domain
> 08/15/2006 00:00:01 NODE4-ERX1 Stop user_name14 at domain
> 08/15/2006 00:00:01 NODE2-ERX1 Stop user_name15 at domain
> 08/15/2006 00:00:02 NODE3-ERX1 Stop user_name16 at domain
> 08/15/2006 00:00:02 NODE5-ERX1 Stop user_name17 at domain
> 08/15/2006 00:00:07 NODE2-ERX1 Stop user_name18 at domain
> 08/15/2006 00:00:07 NODE3-ERX1 Stop user_name19 at domain
> 08/15/2006 00:00:08 NODE4-ERX1 Start user_name20 at domain
>
> What I really see are the following records (in single log file there
> are 166 such records) that precede my 'correct' records (presented above) :
>
> 08/14/2006 23:59:26 NODE2-ERX1 Start user_name1 at domain
> 07/28/2006 14:01:33 NODE3-ERX1 Start user_name2 at domain
> 06/28/2006 03:43:57 NODE5-ERX1 Start user_name3 at domain
> 08/14/2006 23:57:56 NODE2-ERX1 Start user_name4 at domain
> 08/14/2006 21:55:00 NODE2-ERX1 Start user_name5 at domain
> 08/14/2006 23:53:56 NODE3-ERX1 Start user_name7 at domain
> 06/26/2006 11:25:05 NODE4-ERX1 Start user_name8 at domain
> 08/14/2006 23:13:06 NODE5-ERX1 Start user_name9 at domain
> 06/23/2006 05:32:17 NODE2-ERX1 Start user_name10 at domain
> 08/14/2006 23:52:44 NODE2-ERX1 Start user_name11 at domain
> 08/14/2006 23:53:38 NODE2-ERX1 Start user_name12 at domain
>
> and then my regular records appear.
>
> 08/15/2006 00:00:00 NODE1-ERX1 Stop user_name13 at domain
> 08/15/2006 00:00:01 NODE4-ERX1 Stop user_name14 at domain
> 08/15/2006 00:00:01 NODE2-ERX1 Stop user_name15 at domain
> 08/15/2006 00:00:02 NODE3-ERX1 Stop user_name16 at domain
> 08/15/2006 00:00:02 NODE5-ERX1 Stop user_name17 at domain
> 08/15/2006 00:00:07 NODE2-ERX1 Stop user_name18 at domain
> 08/15/2006 00:00:07 NODE3-ERX1 Stop user_name19 at domain
> 08/15/2006 00:00:08 NODE4-ERX1 Start user_name20 at domain
>
> This happens every day and it is completely not understandable.
> As you can see there are only START records
> For me it looks like the log opens always with that 'historical' content
> and that irregularity stops when the first 'correct' record is writen down.
>
> any idea ??
>
> Regards
> Piestaga
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>   
And this is why I prefer that list instead the others :-)

This is the answer I have been looking for.
I have Enterprise Edition of that radius and I had no idea that there is 
such option.

Thank you very much.

Regards
Piestaga