Suspicious Users and Radius Status

Suspicious Users

Reports → Suspicious Users checks the users who are online right now and lists those that look unusual. Each row has a Flag:

Flag Meaning What to check INVALID_USER An online session for a username that doesn't exist (for example a deleted user who is still connected). Disconnect the session from Online Users or the router. EXCEEDED_SESSIONS The user has more open sessions than allowed (Simultaneous Sessions). Shared account, or old sessions that were not closed. EXPIRATION_FUTURE The expiration date is more than 100 days away from today (far in the future, or expired long ago but still online). Check the expiration date and the user's history.

Columns: Username, Expiration, Name, Flag.

Required permission: Report - Suspicious Users

Radius Status

Reports → Radius Status ("FreeRADIUS Engine Statistics") shows counters of the RADIUS server since it was last started, refreshed every 60 seconds:

• Authentication: Access Requests, Access Accepts, Access Rejects, Duplicate, Malformed, Invalid and Dropped Requests.
• Accounting: Accounting Requests and Responses, Duplicate, Malformed, Invalid and Dropped Requests.

Many Duplicate or Dropped requests mean the routers are resending requests because the server answers too slowly. Many Rejects: check the User Auth Log and Login Errors. If the page shows Failed to retrieve RADIUS statistics, the RADIUS status service is not enabled on the server; contact Snono support.