Here's raport, which chews through the detail logs and produces a
report of which lines are used and how much. Bad lines stand out
pretty clearly with this program. It's left as an exercise for the
reader to 1) add gethostbyaddr() to print hostnames instead of IP
addresses, and 2) modify this so that it calculates the mean and
standard deviation in order to flag the lines that are 3 sigma off the
mean (or whatever limit you prefer).
192.168.1.18 1 1015 620:11:31
192.168.1.18 2 524 343:09:10
192.168.1.18 3 190 88:11:03
192.168.1.18 4 84 43:16:23
192.168.1.18 5 117 70:38:56
192.168.1.18 9 68 53:43:30
192.168.1.18 10 125 718:11:54
192.168.1.18 11 334 736:23:09
#!/usr/local/bin/perl
# raport - create a quick port-by-port summary of RADIUS Accounting detail files
#
# 94/12/04 Author: Carl Rigney; cdr@livingston.com
#
# input files = /usr/adm/radacct/*/detail
#
# output:
# 158.222.1.9 0 361 147:36:27
# PortMaster, Port, number of accesses, total elapsed time used
$/ = ''; # read paragraph at a time
while (<>) {
next if /Acct-Session-Id = "00000000"/;
if (/Acct-Status-Type = Stop/) {
if (/Acct-Session-Id = "([^"]+)"/) {
$id = $1;
if (/Client-Id = (\S+)/) {
$nas = $1;
$id .= '@'.$nas;
if ($seen{$id}++) {
$dup++;
next;
}
}
} else {
$err{'No ID'}++;
next;
}
if (/Client-Id = (\S+)/) {
$nas = $1;
if (/Client-Port-Id = (\d+)/) {
$port = $1;
$user = sprintf("%s\t%2d",$nas,$port);
if (/Acct-Session-Time = (\d+)/) {
$elapsed = $1;
if ($elapsed > 0) {
$uses{$user}++;
$used{$user} += $elapsed;
}
}
}
}
}
}
print "# $dup duplicates\n" if $dup;
print "# $err{'No ID'} stop records without Acct-Session-ID\n" if $err{'No Id'};
for $user (sort keys %used) {
printf "%-16s\t%4d\t%s\n",$user,$uses{$user},&hms($used{$user});
}
sub hms {
local($h,$m);
local ($s) = shift(@_);
$m = int($s / 60);
$s = $s % 60;
$h = int($m / 60);
$m = $m % 60;
sprintf("%4d:%02d:%02d",$h,$m,$s);
}
-- Carl Rigney cdr@livingston.com