Live throughput
Accounting write failures
Records that failed to write to a sink (e.g. radacct) β every one is a lost or delayed accounting record. Reasons below help pinpoint schema/data issues fast.
Recent failures
| Time | Sink | Records | Error | Query |
|---|---|---|---|---|
| no accounting failures recorded | ||||
Analytics engine
Authentication requests β /s
Accounting requests β /s
Accounting by type /s Start β Stop β Interim β
A Stop (or a spike) far above Start is a BNG-drop signal β the stale-session storm.
Health & Analytics
Engine counters are read from memory (zero impact); the per-BNG table queries the separate auth-log DB (cached 30s, on demand).
Engine health
β
Authentication by BNG
| BNG (NAS IP) | Unique | Attempts | Success | Expired | Not found | Bad pw | Sim use | Suspended | MAC bind |
|---|---|---|---|---|---|---|---|---|---|
| β | |||||||||
Test authentication (sends an Access-Request to the engine)
Subscriber lookup & status
Session control β CoA / Disconnect
Sends RFC 5176 to the NAS. Needs the NAS reachable on its CoA port (default 3799).
CoA / Disconnect statistics
Send outcomes since this admin process started. Success = NAS ACK; Failed = NAK or send error.
Recent activity
| Time | Action | NAS | Username | Result |
|---|---|---|---|---|
| no CoA/Disconnect sent yet | ||||
Live engine logs β streamed from the engine's memory (no SSH, no tail)
Tip: set Log level to debug in Server Config to surface debug lines here (applies live).
Runtime settings
hot applies instantly; restart settings apply after Restart engine.
Timezone restart β zone for radacct + auth-log timestamps
Default is System (server time) β the host's clock. Pick a zone only to override it; applies after Restart engine.
Authentication methods hot β which auth types this server accepts
Leave all enabled to accept any method. Disabling a method makes the server reject requests that use it.
Auth logging restart β capture every authentication to one target
Listeners β AAA UDP ports hot β port change rebinds the socket live
| Listener | Type | Address | Port | Workers |
|---|---|---|---|---|
| β | ||||
Databases & sinks restart β edit, Test, then Restart engine to reconnect
β
Test a connection β validate before saving (nothing is stored)
Auth-log sink hot-apply β switch backend live; the engine validates the new sink before swapping
β
Batch tuning β blank = sink default (ClickHouse: 10000 / 1s / 100000)
Reply messages β edit & Save, applies live (#max# = sim-use limit)
Console network access β restrict which IPs can reach this admin console
β When restricted, only these networks (plus loopback 127.0.0.1, always allowed to prevent lock-out) can reach the console β everyone else gets a 403.
EAP-TLS / PEAP certificate β server identity for TLS-based auth
Generate a self-signed CA + server certificate. Install the CA on your supplicants/BNGs as the trust anchor; the private keys stay on the server for the engine's TLS handshake and are never downloadable.
β
Advanced β any config key
Active overrides
| Key | Value | |
|---|---|---|
| none | ||
Runtime attribute rewrite β override request/reply attributes at 5 lifecycle stages (the FreeRADIUS unlang analogue). Every change applies live.
β
| Stage | Rule | On | When | Then / Else | |
|---|---|---|---|---|---|
| β | |||||
Advanced β edit raw YAML
The full rules file. A parse/validation error is shown and nothing changes.
Configuration change log
| Key | Old β New | By |
|---|---|---|
| β | ||
License
Read-only status from this install's License Agent. Issuing, renewing, or revoking a license happens in the cloud console, never here.
Entitlements
| Max NAS | Max subscribers | NAS types | Features |
|---|---|---|---|
| β | |||
Updates
Click Update to download, verify, and switch to a version β progress shows step by step. If anything goes wrong, it rolls back to the version you're on now automatically.
β
β
Available versions
| Version | Released | Notes | Status | |
|---|---|---|---|---|
| click "Check for updates" | ||||
Change password
Two-step verification (Google Authenticator) β
Create user
Read-only users can view dashboards, logs and subscribers but cannot change settings or see Server Config.
Users
| Username | Access | 2FA | |
|---|---|---|---|
| β | |||
API keys (service integrations β captive-portal CoA/Disconnect, scripts)
CoA/Disconnect needs a Full access key. Send it as Authorization: Bearer irk_β¦. Shown once β copy it immediately. Restrict callers under Server Config β Access.
Active keys
| Name | Access | Created | Last used | Status | |
|---|---|---|---|---|---|
| β | |||||