Suspicious Users and Radius Status
Suspicious Users
Reports → Suspicious Users checks the users who are online right now and lists those that look unusual. Each row has a Flag:
| Flag | Meaning | What to check |
|---|---|---|
| INVALID_USER | An online session for a username that doesn't exist (for example a deleted user who is still connected). | Disconnect the session from Online Users or the router. |
| EXCEEDED_SESSIONS | The user has more open sessions than allowed (Simultaneous Sessions). | Shared account, or old sessions that were not closed. |
| EXPIRATION_FUTURE | The expiration date is more than 100 days away from today (far in the future, or expired long ago but still online). | Check the expiration date and the user's history. |
Columns: Username, Expiration, Name, Flag.
Required permission: Report - Suspicious Users
Radius Status
Reports → Radius Status ("FreeRADIUS Engine Statistics") shows counters of the RADIUS server since it was last started, refreshed every 60 seconds:
- Authentication: Access Requests, Access Accepts, Access Rejects, Duplicate, Malformed, Invalid and Dropped Requests.
- Accounting: Accounting Requests and Responses, Duplicate, Malformed, Invalid and Dropped Requests.
Many Duplicate or Dropped requests mean the routers are resending requests because the server answers too slowly. Many Rejects: check the User Auth Log and Login Errors. If the page shows Failed to retrieve RADIUS statistics, the RADIUS status service is not enabled on the server; contact Snono support.