# Suspicious Users and Radius Status

## Suspicious Users

*Reports → Suspicious Users* checks the users who are online right now and lists those that look unusual. Each row has a **Flag**:

<table id="bkmrk-flagmeaningwhat-to-c" style="width: 100%;"><thead><tr><th style="width: 20.017%;">Flag</th><th style="width: 50.5466%;">Meaning</th><th style="width: 29.5353%;">What to check</th></tr></thead><tbody><tr><td style="width: 20.017%;">INVALID\_USER</td><td style="width: 50.5466%;">An online session for a username that doesn't exist (for example a deleted user who is still connected).</td><td style="width: 29.5353%;">Disconnect the session from Online Users or the router.</td></tr><tr><td style="width: 20.017%;">EXCEEDED\_SESSIONS</td><td style="width: 50.5466%;">The user has more open sessions than allowed (Simultaneous Sessions).</td><td style="width: 29.5353%;">Shared account, or old sessions that were not closed.</td></tr><tr><td style="width: 20.017%;">EXPIRATION\_FUTURE</td><td style="width: 50.5466%;">The expiration date is more than 100 days away from today (far in the future, or expired long ago but still online).</td><td style="width: 29.5353%;">Check the expiration date and the user's history.</td></tr></tbody></table>

Columns: Username, Expiration, Name, Flag.

*Required permission: Report - Suspicious Users*

## Radius Status

*Reports → Radius Status* ("FreeRADIUS Engine Statistics") shows counters of the RADIUS server since it was last started, refreshed every 60 seconds:

- **Authentication**: Access Requests, Access Accepts, Access Rejects, Duplicate, Malformed, Invalid and Dropped Requests.
- **Accounting**: Accounting Requests and Responses, Duplicate, Malformed, Invalid and Dropped Requests.

Many **Duplicate** or **Dropped** requests mean the routers are resending requests because the server answers too slowly. Many **Rejects**: check the [User Auth Log and Login Errors](https://help.snono-systems.com/books/sas-radius/page/user-auth-log-and-login-errors). If the page shows *Failed to retrieve RADIUS statistics*, the RADIUS status service is not enabled on the server; contact Snono support.