Logging Parameters for TacPlus

[mattablaze]

Hey Marc, I've been playing with the logging configuration and have a couple questions.

1. I really want to combine the author.log, authen.log, and accounting.log files into one file. There's really only one field that I need from the author.log that isn't in the accounting.log. I tried to use this syntax in your documentation:

accounting log format = "${nas}${FS}${user}${FS}${port}${FS}${nac}${FS}${profile}${FS}${result}${FS}${accttype}${FS}${service}${FS}${cmd}"

Adding that to the config file tacplus fails to start. Does this have to go in a specific place? It doesn't matter what the format is - it fails to start every time. Even adding just accounting log format = "${nas}$" as an example fails.

2. Is there any way to move the tacplus messages that are getting put into /var/log/syslog into a tacplus log? Like put those in /var/log/tac_plus_ng/syslog. I'm just trying to keep /var/log/syslog clean of unwanted logging and helps when sending these logs to our SIEM.

[MarcJHuber]

Hi,

apologies, that looks like a documentation error. Does "accounting format = ..." in "log ... { ... }" context work?

Regarding syslog: you can set both "syslog facility" and "syslog level", e.g.:

syslog facility = MAIL
syslog level = DEBUG

to guide your syslogd to write to the right file. Some syslog daemons (rsyslogs, e.g.) also allow for message-based destination selection.

Cheers,

Marc

[mattablaze]

Hmm, I tried a couple things. Here's the full logging config for context with suggested change in the middle:

    log authorlog { destination = /var/log/tac_plus_ng/author.log }
    log authenlog { destination = /var/log/tac_plus_ng/authen.log }
    log connlog { destination = /var/log/tac_plus_ng/conn.log }
    log acctlog { destination = /var/log/tac_plus_ng/accounting.log }

    accounting format = "${nas}${FS}${user}${FS}${port}${FS}${nac}${FS}${profile}${FS}${result}${FS}${accttype}${FS}${service}${FS}${cmd}" in log acctlog

    authentication log = authenlog
    authorization log = authorlog
    accounting log = acctlog
    connection log = connlog

Perhaps I'm not understanding your command context. Can you give an example with that format?

And for syslog, Those two commands would defer from logging into the normal /var/log/syslog. I still want to see them, I just want them in different log file locations.

[MarcJHuber]

Hi,

    log acctlog {
        destination = /var/log/tac_plus_ng/accounting.log
        accounting format = "${nas}${FS}${user}${FS}${port}${FS}${nac}${FS}${profile}${FS}${result}${FS}${accttype}${FS}${service}${FS}${cmd}"
    }

should work.

If it doesn't I can easily have a closer look tomorrow. Good Friday gives plenty of free time for further checking.

Cheers,

Marc