bvantagelimited / freeradius_exporter

FreeRADIUS Prometheus Exporter

FreeRADIUS Prometheus Exporter

Prometheus exporter for FreeRADIUS metrics.

Supports FreeRADIUS 3.0.x.

Installation

go install github.com/bvantagelimited/freeradius_exporter@latest

Requirements

FreeRADIUS status server must be configured.

Usage

Name	Description
radius.address	Address of FreeRADIUS status server, defaults to 127.0.0.1:18121.
radius.secret	FreeRADIUS client secret, defaults to adminsecret.
radius.timeout	Timeout, in milliseconds, defaults to 5000.
radius.homeservers	Addresses of home servers separated by comma, e.g. "172.28.1.2:1812,172.28.1.3:1812"
web.listen-address	Address to listen on for web interface and telemetry, defaults to :9812.
web.telemetry-path	Path under which to expose metrics, defaults to /metrics.
version	Display version information
config	Config file (optional)

Environment Variables

Name	Description
RADIUS_ADDRESS	Address of FreeRADIUS status server.
RADIUS_SECRET	FreeRADIUS client secret.
RADIUS_TIMEOUT	Timeout, in milliseconds.
RADIUS_HOMESERVERS	Addresses of home servers separated by comma, e.g. "172.28.1.2:1812,172.28.1.3:1812"

Metrics

Metric	Notes
freeradius_total_access_requests	Total access requests
freeradius_total_access_accepts	Total access accepts
freeradius_total_access_rejects	Total access rejects
freeradius_total_access_challenges	Total access challenges
freeradius_total_auth_responses	Total auth responses
freeradius_total_auth_duplicate_requests	Total auth duplicate requests
freeradius_total_auth_malformed_requests	Total auth malformed requests
freeradius_total_auth_invalid_requests	Total auth invalid requests
freeradius_total_auth_dropped_requests	Total auth dropped requests
freeradius_total_auth_unknown_types	Total auth unknown types
freeradius_total_proxy_access_requests	Total proxy access requests
freeradius_total_proxy_access_accepts	Total proxy access accepts
freeradius_total_proxy_access_rejects	Total proxy access rejects
freeradius_total_proxy_access_challenges	Total proxy access challenges
freeradius_total_proxy_auth_responses	Total proxy auth responses
freeradius_total_proxy_auth_duplicate_requests	Total proxy auth duplicate requests
freeradius_total_proxy_auth_malformed_requests	Total proxy auth malformed requests
freeradius_total_proxy_auth_invalid_requests	Total proxy auth invalid requests
freeradius_total_proxy_auth_dropped_requests	Total proxy auth dropped requests
freeradius_total_proxy_auth_unknown_types	Total proxy auth unknown types
freeradius_total_acct_requests	Total acct requests
freeradius_total_acct_responses	Total acct responses
freeradius_total_acct_duplicate_requests	Total acct duplicate requests
freeradius_total_acct_malformed_requests	Total acct malformed requests
freeradius_total_acct_invalid_requests	Total acct invalid requests
freeradius_total_acct_dropped_requests	Total acct dropped requests
freeradius_total_acct_unknown_types	Total acct unknown types
freeradius_total_proxy_acct_requests	Total proxy acct requests
freeradius_total_proxy_acct_responses	Total proxy acct responses
freeradius_total_proxy_acct_duplicate_requests	Total proxy acct duplicate requests
freeradius_total_proxy_acct_malformed_requests	Total proxy acct malformed requests
freeradius_total_proxy_acct_invalid_requests	Total proxy acct invalid requests
freeradius_total_proxy_acct_dropped_requests	Total proxy acct dropped requests
freeradius_total_proxy_acct_unknown_types	Total proxy acct unknown types
freeradius_queue_len_internal	Interal queue length
freeradius_queue_len_proxy	Proxy queue length
freeradius_queue_len_auth	Auth queue length
freeradius_queue_len_acct	Acct queue length
freeradius_queue_len_detail	Detail queue length
freeradius_last_packet_recv	Epoch timestamp when the last packet was received
freeradius_last_packet_sent	Epoch timestamp when the last packet was sent
freeradius_start_time	Epoch timestamp when the server was started
freeradius_hup_time	Epoch timestamp when the server hang up (If start == hup, it hasn't been hup'd yet)
freeradius_state	State of the server. Alive = 0; Zombie = 1; Dead = 2; Idle = 3
freeradius_time_of_death	Epoch timestamp when a home server is marked as 'dead'
freeradius_time_of_life	Epoch timestamp when a home server is marked as 'alive'
freeradius_ema_window	Exponential moving average of home server response time
freeradius_ema_window1_usec	Window-1 is the average is calculated over 'window' packets
freeradius_ema_window10_usec	Window-10 is the average is calculated over '10 * window' packets
freeradius_outstanding_requests	Outstanding requests
freeradius_queue_pps_in	Queue PPS in
freeradius_queue_pps_out	Queue PPS out
freeradius_queue_use_percentage	Queue usage percentage
freeradius_stats_error	Stats error as label with a const value of 1

freeradius_exporter's Issues

Don't see any data

Hey, sorry and maby is my configuration wrong. All metrics the exporter displays is 0 except 'freeradius_up'. Im authenticating with eap-tls. The following accounting types are activated: detail, unix, exec. And i can see the statistic type with what the accounting server is answering is "All".

It would be very nice if you can help me.

Metris from Multiple Radius

How to get metrics from multiple radius servers, do we need to add multiple IP in main.go or we need to have multiple variables. Will it work.

Package not found

In reference to issue number 11

Thanks, but it cannot. find the package now

go install github.com/bvantagelimited/freeradius_exporter@latest
can't load package: package github.com/bvantagelimited/freeradius_exporter@latest: cannot find package "github.com/bvantagelimited/freeradius_exporter@latest" in any of:
/usr/lib/go-1.10/src/github.com/bvantagelimited/freeradius_exporter@latest (from $GOROOT)
/root/go/src/github.com/bvantagelimited/freeradius_exporter@latest (from $GOPATH)

Include version info

It would be great to have a version in this package, that can be printed with a -version flag.

This allows to compare versions and automatically upgrade the binary.

See https://github.com/oliver006/redis_exporter/blob/7eb3772cedb28d8c4c0299a8167aa22272be0338/main.go#L53

Config file useage

Hello,
we want to use the freeradius_exporter by copying the binary file included in the releases in conjunction with a config file. How do I configure the usage of the config file or which is the default location for it?

Include internal server statistics

By sending StatisticsTypeAll instead of StatisticsTypeAuthAcctProxyAuthAcct a few interesting internal metrics become available, allowing to monitor potential backlog.

        FreeRADIUS-Stats-Start-Time = "Jun  6 2019 21:35:56 CEST"
        FreeRADIUS-Stats-HUP-Time = "Jun  6 2019 21:35:56 CEST"
        FreeRADIUS-Queue-Len-Internal = 0
        FreeRADIUS-Queue-Len-Proxy = 0
        FreeRADIUS-Queue-Len-Auth = 0
        FreeRADIUS-Queue-Len-Acct = 0
        FreeRADIUS-Queue-Len-Detail = 0
        FreeRADIUS-Queue-PPS-In = 0
        FreeRADIUS-Queue-PPS-Out = 0

radius.homeserver

Hello,
I am getting an error in the syslog for the exporter:
Failed to find home server IP

Can you give me a hint on how the config has to look like when the freeradius and freeradius_exporter are running on the same server? I am not 100% what homeserver refers to in this case.

Installation error

Hi, hope you can help. Not familiar with go, trying to install it on the freeradius server, but when I run:

go get -u github.com/bvantagelimited/freeradius_exporter

I get the following error:

# github.com/prometheus/procfs
go/src/github.com/prometheus/procfs/proc_snmp6.go:147:6: undefined: errors.Is

Anything I'm missing?

External config file

Hi,
Is there a way to add an external default config file, like /etc/default/freeradius_exporter for example?
Thanks.

Build issue with rfc2865 library

Tried this on Debian 10 with golang 1.11 and Ubuntu 20.04 with golang 1.13, but both fail like so:

$ GOPATH=$HOME/go go get -u github.com/bvantagelimited/freeradius_exporter

# github.com/bvantagelimited/freeradius_exporter/freeradius
go/src/github.com/bvantagelimited/freeradius_exporter/freeradius/freeradius.go:170:21: invalid argument p.Attributes[rfc2865.VendorSpecific_Type] (type *radius.AVP) for len
go/src/github.com/bvantagelimited/freeradius_exporter/freeradius/freeradius.go:171:88: invalid operation: p.Attributes[rfc2865.VendorSpecific_Type][i] (type *radius.AVP does not support indexing)
go/src/github.com/bvantagelimited/freeradius_exporter/freeradius/freeradius.go:188:50: invalid operation: p.Attributes[rfc2865.VendorSpecific_Type][i] (type *radius.AVP does not support indexing)
go/src/github.com/bvantagelimited/freeradius_exporter/freeradius/freeradius.go:191:96: cannot slice p.Attributes[rfc2865.VendorSpecific_Type] (type *radius.AVP)
go/src/github.com/bvantagelimited/freeradius_exporter/freeradius/freeradius.go:198:14: cannot range over p.Attributes[rfc2865.VendorSpecific_Type] (type *radius.AVP)

Per client_access in addition to total_access

Hello, I have your exporter running in a home lab docker container and successfully outputting to grafana. Thank you for creating the exporter as it allows me to trap and alert for access-reject messages via grafana.

Is there any way to obtain access-reject/accept etc per radius user? I mostly use mac authentication via unifi aps and would like to see how often a given mac address is authenticating.
Thanks again.

Some Metrics from README not available

Hello!

I have been working on implementing this exporter for some RADIUS servers I use.

I was looking over the README and can see the the following metrics are listed:

freeradius_last_packet_recv

freeradius_last_packet_sent

freeradius_state

freeradius_queue_use_percentage

After setting up the exporter on a couple different RADIUS systems, I am noticing the above 4 metrics are not present.

I also tried using radclient to emulate the commands pointed at RADIUS status server but did not have much luck.

[root@bru-cprad-1dev ~]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 185, FreeRADIUS-Stats-Server-Port = 1812, FreeRADIUS-Stats-Server-IP-Address = 127.0.0.1" | radclient -x localhost:18121 status testing
Sent Status-Server Id 34 from 0.0.0.0:39544 to 127.0.0.1:18121 length 74
        Message-Authenticator = 0x00
        FreeRADIUS-Statistics-Type = 185
        FreeRADIUS-Stats-Server-Port = 1812
        FreeRADIUS-Stats-Server-IP-Address = 127.0.0.1
Received Access-Accept Id 34 from 127.0.0.1:18121 to 0.0.0.0:0 length 128
        FreeRADIUS-Stats-Start-Time = "Mar 18 2024 11:07:44 EDT"
        FreeRADIUS-Stats-HUP-Time = "Mar 18 2024 11:07:44 EDT"
        FreeRADIUS-Queue-Len-Internal = 0
        FreeRADIUS-Queue-Len-Proxy = 0
        FreeRADIUS-Queue-Len-Auth = 0
        FreeRADIUS-Queue-Len-Acct = 0
        FreeRADIUS-Queue-Len-Detail = 0
        FreeRADIUS-Queue-PPS-In = 0
        FreeRADIUS-Queue-PPS-Out = 0
[root@bru-cprad-1dev ~]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 184, FreeRADIUS-Stats-Server-Port = 1812, FreeRADIUS-Stats-Server-IP-Address = 127.0.0.1" | radclient -x localhost:18121 status testing
Sent Status-Server Id 98 from 0.0.0.0:35769 to 127.0.0.1:18121 length 74
        Message-Authenticator = 0x00
        FreeRADIUS-Statistics-Type = 184
        FreeRADIUS-Stats-Server-Port = 1812
        FreeRADIUS-Stats-Server-IP-Address = 127.0.0.1
Received Access-Accept Id 98 from 127.0.0.1:18121 to 0.0.0.0:0 length 128
        FreeRADIUS-Stats-Start-Time = "Mar 18 2024 11:07:44 EDT"
        FreeRADIUS-Stats-HUP-Time = "Mar 18 2024 11:07:44 EDT"
        FreeRADIUS-Queue-Len-Internal = 0
        FreeRADIUS-Queue-Len-Proxy = 0
        FreeRADIUS-Queue-Len-Auth = 0
        FreeRADIUS-Queue-Len-Acct = 0
        FreeRADIUS-Queue-Len-Detail = 0
        FreeRADIUS-Queue-PPS-In = 0
        FreeRADIUS-Queue-PPS-Out = 0

Any input on these 4 metrics would be greatly appreciated!

Thanks!
Rhys

Use a hostname for RADIUS_ADDRESS

Thank you for freeradius_exporter

We are using the exporter in a docker compose context with FreeRADIUS, MariaDB and freeradius_exporter. The fact that freeradius_exporter only accepts an IP address for the RADIUS server is a drawback since it necessitates adding specific (private) IP addresses for the FreeRADIUS server and freeradius_exporter containers.

It would be very helpful if freeradius_exporter also accepted hostnames since Docker will automagically assign the service name to an IP address. That way we can use RADIUS_ADDRESS=radius:1812 instead of RADIUS_ADDRESS=10.5.0.5:1812

Document exported metrics

I'd like to know what metrics are exported before I set the exporter up, please document an example output in the README.md.
Thanks !

Set default secret to default of freeradius

The default secret for the status virtual server of FreeRADIUS is adminsecret, setting the default in this exporter to the same makes it easier to start using it when you leave things to default.

By default, the virtual server listens only on local host, so this doesn't pose that much of a security risk.