├── README.md
├── analyze_influx.php
├── LICENSE
├── grafana_dashboard.json
└── radius_functions.php


/README.md:
--------------------------------------------------------------------------------
 1 | # InfluxDB RADIUS Analyzer
 2 | 
 3 | ![Example grafana log](https://www.pictshare.net/800/22ca68ad0e.jpg)
 4 | 
 5 | Compatible with all versions of InfluxDB since it uses UDP and the line protocol.
 6 | 
 7 | ## Updating
 8 | You can update by copying the whole script but make sure to check the first lines of analyze_influx.php for (new) settings since the settings will be overwritten after each update because for now I'm too lazy to proper implement the config in an external file, sorry.
 9 | 
10 | How to use: https://blog.haschek.at/2016-how-to-visualize-radius-connections


--------------------------------------------------------------------------------
/analyze_influx.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | require_once 'radius_functions.php';
  3 | date_default_timezone_set('Europe/Vienna');
  4 | error_reporting(E_ALL & ~E_NOTICE);
  5 | 
  6 | define('IMPORT_OLD',false);
  7 | define('USERADIUSTIME',true);
  8 | define('PATH',"C:\\Windows\\System32\\LogFiles\\IN");
  9 | define('DBNAME','radius');
 10 | define('DBIP','192.168.1.117');
 11 | define('DBPORT',8090);
 12 | define('ONLYNEWDATA',true);
 13 | define('DAILYLOGS',false);
 14 | 
 15 | if(!IMPORT_OLD)
 16 |     /* Prduction: */
 17 |     follow(false);
 18 | else
 19 | {
 20 | 	/* IMPORT_OLD data from 2010 to 2015 */
 21 | 	for($year=10;$year<16;$year++)
 22 | 	{
 23 | 		for($i=1;$i<13;$i++)
 24 | 		{
 25 | 			$month = ($i<10)?'0'.$i:$i;
 26 | 			follow($year.$month);
 27 | 		}
 28 | 	}
 29 | }
 30 | 
 31 | 
 32 | function saveLastTime($time)
 33 | {
 34 |     $fp = fopen('lasttime.txt','w');
 35 |     fwrite($fp,$time);
 36 |     fclose($fp);
 37 | }
 38 | 
 39 | function follow($forcedate=false)
 40 | {
 41 |     if(!$forcedate)
 42 |     {
 43 |         $datestring = DAILYLOGS?date("y").date("m").date("d"):date("y").date("m");
 44 |         $file = PATH.$datestring.'.log';
 45 |     }
 46 |     else 
 47 |     {
 48 |         $datestring = $forcedate;
 49 |         $file = PATH.$datestring.'.log';
 50 |     }
 51 |     
 52 |         
 53 |     if(ONLYNEWDATA)
 54 |     {
 55 |         $lasttime = implode(NULL,@file('lasttime.txt'));
 56 |     }
 57 | 
 58 |     $size = 0;
 59 |     while (true) {
 60 |         clearstatcache();
 61 |         $currentSize = filesize($file);
 62 |         if ($size == $currentSize){
 63 | 			if(IMPORT_OLD){echo "[done]\n"; return;}
 64 |             usleep(100);
 65 |             continue;
 66 |         }
 67 |         
 68 |         // renew datestring and file name so it will automatically
 69 |         // choose the right file when the date changes
 70 |         if(!$forcedate)
 71 |         {
 72 |             $datestring = DAILYLOGS?date("y").date("m").date("d"):date("y").date("m");
 73 |             $file = PATH.$datestring.'.log';
 74 |         }
 75 | 
 76 |         $fh = fopen($file, "r");
 77 |         fseek($fh, $size);
 78 | 
 79 |         while ($d = fgets($fh))
 80 |         {
 81 |             $d = trim($d);
 82 |             $a = explode(',', $d);
 83 |             $server =   str_replace('"','',$a[0]);
 84 |             $date =     str_replace('"','',$a[2]);
 85 |             $time =     str_replace('"','',$a[3]);
 86 |             $timestamp = strtotime($date.' '.$time);
 87 |             
 88 |             if(ONLYNEWDATA && $timestamp<$lasttime) continue;
 89 |                 
 90 |             saveLastTime($timestamp);
 91 | 
 92 |             $type =     str_replace('"','',$a[4]);
 93 |             $client =   str_replace('"','',$a[5]);
 94 |             $origin =   str_replace('"','',$a[6]);
 95 |             $client_mac =   trim(str_replace('"','',str_replace('-',':',$a[8])));
 96 |             if($client_mac && !strpos($client_mac,':'))
 97 |                 $client_mac = chunk_split($client_mac, 2, ':');
 98 |             $ap_host =  str_replace('"','',$a[11]);
 99 |             $ap_ip =    str_replace('"','',$a[15]);
100 |             $ap_radname=strtolower(str_replace('"','',substr($a[16], 0,5)));
101 |             $ap_radname_full= strtolower(str_replace('"','',sanatizeStringForInflux($a[16])));
102 |             $speed =    str_replace('"','',$a[20]);
103 |             $policy =   str_replace('"','',$a[60]);
104 |             $auth =   translateAuth(str_replace('"','',$a[23]));
105 |             $policy2 =   str_replace('"','',$a[24]);
106 |             $reason =   str_replace('"','',$a[25]);
107 |             $rs = translateReason($reason);
108 | 
109 |             $tt = translatePackageType($type);
110 |             $tq = round($timestamp/900)*900;
111 | 
112 |             //$origin_client = substr($origin, strpos($origin, '\\')+1);
113 |             //if(!$origin_client) continue;
114 | 			
115 | 			if(strpos($origin,'\\'))
116 | 				$ab = explode('\\',$origin);
117 | 			else if(strpos($origin,'/'))
118 | 				$ab = explode('/',$origin);
119 | 				
120 | 			if(is_array($ab)){
121 | 				
122 | 				if(count($ab)==4)
123 | 				{
124 | 					$origin_client = $ab[3];
125 | 					$OU = $ab[2];
126 | 				}
127 | 				else if(count($ab)==3)
128 | 				{
129 | 					$origin_client = $ab[2];
130 | 					$OU = $ab[1];
131 | 				}
132 | 				else if(count($ab)==2)
133 | 				{
134 | 					$origin_client = $ab[1];
135 | 					$OU = $ab[0];
136 | 				}
137 | 				else {
138 | 					$origin_client = $origin;
139 | 				}
140 | 				
141 | 			} 
142 | 			else
143 | 			{
144 | 				$origin_client = $origin;
145 | 			}
146 | 
147 | 			$influxtime = $timestamp.'000000000';
148 |             
149 |             $OU = sanatizeStringForInflux($OU);
150 |             $origin_client = sanatizeStringForInflux($origin_client);
151 | 
152 | 
153 |             switch($type)
154 |             {
155 |                 case 1: //Requesting access
156 |                     if($requests[$origin_client.$ap_radname_full]==$timestamp) continue 2;
157 | 					
158 | 					$s = explode(' ',$speed);
159 | 					$speed = $s[1];
160 |                     
161 |                     $requests[$origin_client.$ap_radname_full]=$timestamp;
162 |                     //echo date("d.m H:I:s",$timestamp).": $origin_client trying to connect via $ap_radname_full\n";
163 | 
164 |                     //making sure all tag values are set and if not, set them to "0"
165 | 					$client_mac = ($client_mac?$client_mac:'0');
166 |                     $ap_radname_full = ($ap_radname_full?$ap_radname_full:'0');
167 |                     $origin_client = ($origin_client?$origin_client:'0');
168 | 
169 | 					sendToDB(DBNAME.",type=request,ap=$ap_radname_full,special=$client_mac,special_type=mac value=\"$origin_client\",special=\"$client_mac\"",$influxtime);
170 |                 break;
171 | 
172 |                 case 2: //Accepted
173 |                     //echo "$origin_client is accepted on $ap_radname_full\n\n";
174 | 
175 |                     //making sure all tag values are set and if not, set them to "0"
176 |                     $OU = ($OU?$OU:'0');
177 |                     $ap_radname_full = ($ap_radname_full?$ap_radname_full:'0');
178 |                     $origin_client = ($origin_client?$origin_client:'0');
179 | 
180 |                     sendToDB(DBNAME.",type=accept,ap=$ap_radname_full,special=$OU,special_type=OU value=\"$origin_client\"",$influxtime);
181 |                 break;
182 | 
183 |                 case 3: //Rejected
184 |                     //echo "$origin_client is rejected because: $rs\n\n";
185 |                     
186 |                     //making sure all tag values are set and if not, set them to "0"
187 |                     $ap_radname_full = ($ap_radname_full?$ap_radname_full:'0');
188 |                     $reason = ($reason?$reason:'0');
189 |                     $origin_client = ($origin_client?$origin_client:'0');
190 |                     $rs = ($rs?$rs:'0');
191 |                     sendToDB(DBNAME.",type=rejected,ap=$ap_radname_full,special=$reason,special_type=reason value=\"$origin_client\",special_val=\"$rs\"",$influxtime);
192 |                 break;
193 | 
194 |                 case 4: //Accounting-Request
195 | 
196 |                 break;
197 | 
198 |                 case 5: //Accounting-Response
199 | 
200 |                 break;
201 | 
202 |                 case 11: //Access-Challenge
203 | 
204 |                 break;
205 | 
206 |                 default:
207 |                     //echo "$reason\t$origin_client\t$timestamp\t$client\t$tt\t$ap_radname_full\n";
208 |             }
209 | 
210 |         }
211 | 		
212 | 		echo "[+] added $datestring\n";
213 | 
214 |         $out = array();
215 | 
216 |         fclose($fh);
217 |         $size = $currentSize;
218 |     }
219 | }
220 | 
221 | function sendToDB($data,$time=false)
222 | {
223 | 	//echo "[+] $data\n"; return;
224 | 	$socket = stream_socket_client("udp://".DBIP.":".DBPORT);
225 | 	stream_socket_sendto($socket, $data.(USERADIUSTIME?' '.$time:''));
226 | 	stream_socket_shutdown($socket, STREAM_SHUT_RDWR);
227 | }
228 | 
229 | 
230 | function sanatizeStringForInflux($string)
231 | {
232 |     $string = trim($string);
233 |     $string = str_replace(',','\\,',$string);
234 |     $string = str_replace(' ','\\ ',$string);
235 |     $string = str_replace('=','\\=',$string);
236 |     return $string;
237 | }
238 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "[]"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright [yyyy] [name of copyright owner]
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------
/grafana_dashboard.json:
--------------------------------------------------------------------------------
  1 | {
  2 |   "id": 3,
  3 |   "title": "RADIUS",
  4 |   "originalTitle": "RADIUS",
  5 |   "tags": [],
  6 |   "style": "dark",
  7 |   "timezone": "browser",
  8 |   "editable": true,
  9 |   "hideControls": false,
 10 |   "sharedCrosshair": false,
 11 |   "rows": [
 12 |     {
 13 |       "collapse": false,
 14 |       "editable": true,
 15 |       "height": "250px",
 16 |       "panels": [
 17 |         {
 18 |           "aliasColors": {},
 19 |           "bars": false,
 20 |           "datasource": "radius",
 21 |           "editable": true,
 22 |           "error": false,
 23 |           "fill": 1,
 24 |           "grid": {
 25 |             "leftLogBase": 1,
 26 |             "leftMax": null,
 27 |             "leftMin": null,
 28 |             "rightLogBase": 1,
 29 |             "rightMax": null,
 30 |             "rightMin": null,
 31 |             "threshold1": null,
 32 |             "threshold1Color": "rgba(216, 200, 27, 0.27)",
 33 |             "threshold2": null,
 34 |             "threshold2Color": "rgba(234, 112, 112, 0.22)"
 35 |           },
 36 |           "id": 1,
 37 |           "interval": ">30m",
 38 |           "isNew": true,
 39 |           "legend": {
 40 |             "alignAsTable": false,
 41 |             "avg": false,
 42 |             "current": false,
 43 |             "max": false,
 44 |             "min": false,
 45 |             "show": true,
 46 |             "total": false,
 47 |             "values": false
 48 |           },
 49 |           "lines": true,
 50 |           "linewidth": 2,
 51 |           "links": [],
 52 |           "nullPointMode": "connected",
 53 |           "percentage": false,
 54 |           "pointradius": 5,
 55 |           "points": false,
 56 |           "renderer": "flot",
 57 |           "seriesOverrides": [],
 58 |           "span": 6,
 59 |           "stack": false,
 60 |           "steppedLine": true,
 61 |           "targets": [
 62 |             {
 63 |               "alias": "[[tag_ap]]",
 64 |               "dsType": "influxdb",
 65 |               "groupBy": [
 66 |                 {
 67 |                   "params": [
 68 |                     "$interval"
 69 |                   ],
 70 |                   "type": "time"
 71 |                 },
 72 |                 {
 73 |                   "params": [
 74 |                     "ap"
 75 |                   ],
 76 |                   "type": "tag"
 77 |                 },
 78 |                 {
 79 |                   "params": [
 80 |                     "null"
 81 |                   ],
 82 |                   "type": "fill"
 83 |                 }
 84 |               ],
 85 |               "measurement": "radius",
 86 |               "query": "SELECT count(\"value\") FROM \"radius\" WHERE \"ap\" <> '0' AND $timeFilter GROUP BY time($interval), \"ap\" fill(null)",
 87 |               "rawQuery": false,
 88 |               "refId": "A",
 89 |               "resultFormat": "time_series",
 90 |               "select": [
 91 |                 [
 92 |                   {
 93 |                     "params": [
 94 |                       "value"
 95 |                     ],
 96 |                     "type": "field"
 97 |                   },
 98 |                   {
 99 |                     "params": [],
100 |                     "type": "count"
101 |                   }
102 |                 ]
103 |               ],
104 |               "tags": [
105 |                 {
106 |                   "key": "ap",
107 |                   "operator": "<>",
108 |                   "value": "0"
109 |                 }
110 |               ]
111 |             }
112 |           ],
113 |           "timeFrom": null,
114 |           "timeShift": null,
115 |           "title": "Requests by AP",
116 |           "tooltip": {
117 |             "shared": true,
118 |             "value_type": "cumulative"
119 |           },
120 |           "type": "graph",
121 |           "x-axis": true,
122 |           "y-axis": true,
123 |           "y_formats": [
124 |             "ops",
125 |             "short"
126 |           ]
127 |         },
128 |         {
129 |           "aliasColors": {},
130 |           "bars": false,
131 |           "datasource": "radius",
132 |           "editable": true,
133 |           "error": false,
134 |           "fill": 1,
135 |           "grid": {
136 |             "leftLogBase": 1,
137 |             "leftMax": null,
138 |             "leftMin": null,
139 |             "rightLogBase": 1,
140 |             "rightMax": null,
141 |             "rightMin": null,
142 |             "threshold1": null,
143 |             "threshold1Color": "rgba(216, 200, 27, 0.27)",
144 |             "threshold2": null,
145 |             "threshold2Color": "rgba(234, 112, 112, 0.22)"
146 |           },
147 |           "id": 2,
148 |           "interval": ">5m",
149 |           "isNew": true,
150 |           "legend": {
151 |             "avg": false,
152 |             "current": false,
153 |             "hideEmpty": false,
154 |             "max": false,
155 |             "min": false,
156 |             "show": true,
157 |             "total": false,
158 |             "values": false
159 |           },
160 |           "lines": true,
161 |           "linewidth": 2,
162 |           "links": [],
163 |           "nullPointMode": "connected",
164 |           "percentage": false,
165 |           "pointradius": 5,
166 |           "points": false,
167 |           "renderer": "flot",
168 |           "seriesOverrides": [
169 |             {
170 |               "alias": "Abgelehnte Logins",
171 |               "color": "#BF1B00"
172 |             }
173 |           ],
174 |           "span": 6,
175 |           "stack": false,
176 |           "steppedLine": false,
177 |           "targets": [
178 |             {
179 |               "alias": "Successful logins",
180 |               "dsType": "influxdb",
181 |               "groupBy": [
182 |                 {
183 |                   "params": [
184 |                     "$interval"
185 |                   ],
186 |                   "type": "time"
187 |                 },
188 |                 {
189 |                   "params": [
190 |                     "null"
191 |                   ],
192 |                   "type": "fill"
193 |                 }
194 |               ],
195 |               "measurement": "radius",
196 |               "query": "SELECT count(\"value\") FROM \"radius\" WHERE \"type\" = 'accept' AND $timeFilter GROUP BY time($interval) fill(null)",
197 |               "rawQuery": false,
198 |               "refId": "A",
199 |               "resultFormat": "time_series",
200 |               "select": [
201 |                 [
202 |                   {
203 |                     "params": [
204 |                       "value"
205 |                     ],
206 |                     "type": "field"
207 |                   },
208 |                   {
209 |                     "params": [],
210 |                     "type": "count"
211 |                   }
212 |                 ]
213 |               ],
214 |               "tags": [
215 |                 {
216 |                   "key": "type",
217 |                   "operator": "=",
218 |                   "value": "accept"
219 |                 }
220 |               ]
221 |             },
222 |             {
223 |               "alias": "Rejected logins",
224 |               "dsType": "influxdb",
225 |               "groupBy": [
226 |                 {
227 |                   "params": [
228 |                     "$interval"
229 |                   ],
230 |                   "type": "time"
231 |                 },
232 |                 {
233 |                   "params": [
234 |                     "null"
235 |                   ],
236 |                   "type": "fill"
237 |                 }
238 |               ],
239 |               "measurement": "radius",
240 |               "query": "SELECT count(\"value\") FROM \"radius\" WHERE \"type\" = 'rejected' AND $timeFilter GROUP BY time($interval) fill(null)",
241 |               "rawQuery": false,
242 |               "refId": "B",
243 |               "resultFormat": "time_series",
244 |               "select": [
245 |                 [
246 |                   {
247 |                     "params": [
248 |                       "value"
249 |                     ],
250 |                     "type": "field"
251 |                   },
252 |                   {
253 |                     "params": [],
254 |                     "type": "count"
255 |                   }
256 |                 ]
257 |               ],
258 |               "tags": [
259 |                 {
260 |                   "key": "type",
261 |                   "operator": "=",
262 |                   "value": "rejected"
263 |                 }
264 |               ]
265 |             }
266 |           ],
267 |           "timeFrom": null,
268 |           "timeShift": null,
269 |           "title": "All requests",
270 |           "tooltip": {
271 |             "shared": true,
272 |             "value_type": "cumulative"
273 |           },
274 |           "type": "graph",
275 |           "x-axis": true,
276 |           "y-axis": true,
277 |           "y_formats": [
278 |             "ops",
279 |             "short"
280 |           ]
281 |         }
282 |       ],
283 |       "title": "Row"
284 |     },
285 |     {
286 |       "collapse": false,
287 |       "editable": true,
288 |       "height": 118,
289 |       "panels": [
290 |         {
291 |           "cacheTimeout": null,
292 |           "colorBackground": false,
293 |           "colorValue": false,
294 |           "colors": [
295 |             "rgba(245, 54, 54, 0.9)",
296 |             "rgba(237, 129, 40, 0.89)",
297 |             "rgba(50, 172, 45, 0.97)"
298 |           ],
299 |           "datasource": "radius",
300 |           "decimals": 0,
301 |           "editable": true,
302 |           "error": false,
303 |           "format": "none",
304 |           "id": 3,
305 |           "interval": null,
306 |           "isNew": true,
307 |           "links": [],
308 |           "maxDataPoints": 100,
309 |           "nullPointMode": "connected",
310 |           "nullText": null,
311 |           "postfix": "",
312 |           "postfixFontSize": "50%",
313 |           "prefix": "",
314 |           "prefixFontSize": "50%",
315 |           "span": 4.14169921875,
316 |           "sparkline": {
317 |             "fillColor": "rgba(31, 118, 189, 0.18)",
318 |             "full": false,
319 |             "lineColor": "rgb(31, 120, 193)",
320 |             "show": true
321 |           },
322 |           "targets": [
323 |             {
324 |               "dsType": "influxdb",
325 |               "groupBy": [
326 |                 {
327 |                   "params": [
328 |                     "$interval"
329 |                   ],
330 |                   "type": "time"
331 |                 },
332 |                 {
333 |                   "params": [
334 |                     "null"
335 |                   ],
336 |                   "type": "fill"
337 |                 }
338 |               ],
339 |               "measurement": "radius",
340 |               "query": "SELECT count(distinct(\"value\")) FROM \"radius\" WHERE $timeFilter GROUP BY time($interval) fill(null)",
341 |               "rawQuery": true,
342 |               "refId": "A",
343 |               "resultFormat": "time_series",
344 |               "select": [
345 |                 [
346 |                   {
347 |                     "params": [
348 |                       "value"
349 |                     ],
350 |                     "type": "field"
351 |                   },
352 |                   {
353 |                     "params": [],
354 |                     "type": "distinct"
355 |                   }
356 |                 ]
357 |               ],
358 |               "tags": []
359 |             }
360 |           ],
361 |           "thresholds": "",
362 |           "title": "Unique users in timespan",
363 |           "type": "singlestat",
364 |           "valueFontSize": "80%",
365 |           "valueMaps": [],
366 |           "valueName": "current"
367 |         },
368 |         {
369 |           "cacheTimeout": null,
370 |           "colorBackground": false,
371 |           "colorValue": false,
372 |           "colors": [
373 |             "rgba(245, 54, 54, 0.9)",
374 |             "rgba(237, 129, 40, 0.89)",
375 |             "rgba(50, 172, 45, 0.97)"
376 |           ],
377 |           "datasource": "radius",
378 |           "decimals": 1,
379 |           "editable": true,
380 |           "error": false,
381 |           "format": "none",
382 |           "id": 4,
383 |           "interval": null,
384 |           "isNew": true,
385 |           "links": [],
386 |           "maxDataPoints": 100,
387 |           "nullPointMode": "connected",
388 |           "nullText": null,
389 |           "postfix": "",
390 |           "postfixFontSize": "50%",
391 |           "prefix": "",
392 |           "prefixFontSize": "50%",
393 |           "span": 4,
394 |           "sparkline": {
395 |             "fillColor": "rgba(31, 118, 189, 0.18)",
396 |             "full": false,
397 |             "lineColor": "rgb(31, 120, 193)",
398 |             "show": true
399 |           },
400 |           "targets": [
401 |             {
402 |               "dsType": "influxdb",
403 |               "groupBy": [
404 |                 {
405 |                   "params": [
406 |                     "$interval"
407 |                   ],
408 |                   "type": "time"
409 |                 },
410 |                 {
411 |                   "params": [
412 |                     "null"
413 |                   ],
414 |                   "type": "fill"
415 |                 }
416 |               ],
417 |               "measurement": "radius",
418 |               "query": "SELECT count(distinct(\"value\")) FROM \"radius\" WHERE $timeFilter GROUP BY time($interval) fill(null)",
419 |               "rawQuery": true,
420 |               "refId": "A",
421 |               "resultFormat": "time_series",
422 |               "select": [
423 |                 [
424 |                   {
425 |                     "params": [
426 |                       "value"
427 |                     ],
428 |                     "type": "field"
429 |                   },
430 |                   {
431 |                     "params": [],
432 |                     "type": "distinct"
433 |                   }
434 |                 ]
435 |               ],
436 |               "tags": []
437 |             }
438 |           ],
439 |           "thresholds": "",
440 |           "title": "Users on average",
441 |           "type": "singlestat",
442 |           "valueFontSize": "80%",
443 |           "valueMaps": [],
444 |           "valueName": "avg"
445 |         },
446 |         {
447 |           "cacheTimeout": null,
448 |           "colorBackground": false,
449 |           "colorValue": false,
450 |           "colors": [
451 |             "rgba(245, 54, 54, 0.9)",
452 |             "rgba(237, 129, 40, 0.89)",
453 |             "rgba(50, 172, 45, 0.97)"
454 |           ],
455 |           "datasource": "radius",
456 |           "decimals": 0,
457 |           "editable": true,
458 |           "error": false,
459 |           "format": "none",
460 |           "id": 6,
461 |           "interval": null,
462 |           "isNew": true,
463 |           "links": [],
464 |           "maxDataPoints": 100,
465 |           "nullPointMode": "connected",
466 |           "nullText": null,
467 |           "postfix": "",
468 |           "postfixFontSize": "50%",
469 |           "prefix": "",
470 |           "prefixFontSize": "50%",
471 |           "span": 3.8583007812499996,
472 |           "sparkline": {
473 |             "fillColor": "rgba(189, 64, 31, 0.18)",
474 |             "full": false,
475 |             "lineColor": "rgb(193, 78, 31)",
476 |             "show": true
477 |           },
478 |           "targets": [
479 |             {
480 |               "dsType": "influxdb",
481 |               "groupBy": [
482 |                 {
483 |                   "params": [
484 |                     "$interval"
485 |                   ],
486 |                   "type": "time"
487 |                 },
488 |                 {
489 |                   "params": [
490 |                     "null"
491 |                   ],
492 |                   "type": "fill"
493 |                 }
494 |               ],
495 |               "measurement": "radius",
496 |               "query": "SELECT count(\"value\") FROM \"radius\" WHERE \"type\" = 'rejected' AND $timeFilter GROUP BY time($interval) fill(null)",
497 |               "rawQuery": false,
498 |               "refId": "B",
499 |               "resultFormat": "time_series",
500 |               "select": [
501 |                 [
502 |                   {
503 |                     "params": [
504 |                       "value"
505 |                     ],
506 |                     "type": "field"
507 |                   },
508 |                   {
509 |                     "params": [],
510 |                     "type": "count"
511 |                   }
512 |                 ]
513 |               ],
514 |               "tags": [
515 |                 {
516 |                   "key": "type",
517 |                   "operator": "=",
518 |                   "value": "rejected"
519 |                 }
520 |               ]
521 |             }
522 |           ],
523 |           "thresholds": "",
524 |           "title": "Rejected logins",
525 |           "type": "singlestat",
526 |           "valueFontSize": "80%",
527 |           "valueMaps": [],
528 |           "valueName": "max"
529 |         }
530 |       ],
531 |       "title": "New row"
532 |     },
533 |     {
534 |       "collapse": false,
535 |       "editable": true,
536 |       "height": 393,
537 |       "panels": [
538 |         {
539 |           "columns": [],
540 |           "datasource": "radius",
541 |           "editable": true,
542 |           "error": false,
543 |           "fontSize": "100%",
544 |           "id": 5,
545 |           "isNew": true,
546 |           "links": [],
547 |           "pageSize": null,
548 |           "scroll": true,
549 |           "showHeader": true,
550 |           "sort": {
551 |             "col": 0,
552 |             "desc": true
553 |           },
554 |           "span": 6.0375,
555 |           "styles": [
556 |             {
557 |               "dateFormat": "YYYY-MM-DD HH:mm:ss",
558 |               "pattern": "Time",
559 |               "type": "date"
560 |             },
561 |             {
562 |               "colorMode": null,
563 |               "colors": [
564 |                 "rgba(245, 54, 54, 0.9)",
565 |                 "rgba(237, 129, 40, 0.89)",
566 |                 "rgba(50, 172, 45, 0.97)"
567 |               ],
568 |               "decimals": 2,
569 |               "pattern": "/.*/",
570 |               "thresholds": [],
571 |               "type": "string",
572 |               "unit": "short"
573 |             }
574 |           ],
575 |           "targets": [
576 |             {
577 |               "dsType": "influxdb",
578 |               "groupBy": [
579 |                 {
580 |                   "params": [
581 |                     "$interval"
582 |                   ],
583 |                   "type": "time"
584 |                 },
585 |                 {
586 |                   "params": [
587 |                     "null"
588 |                   ],
589 |                   "type": "fill"
590 |                 }
591 |               ],
592 |               "measurement": "radius",
593 |               "query": "SELECT \"time\",\"value\" as Benutzer,\"ap\" FROM \"radius\" WHERE \"type\"='accept' AND $timeFilter",
594 |               "rawQuery": true,
595 |               "refId": "A",
596 |               "resultFormat": "table",
597 |               "select": [
598 |                 [
599 |                   {
600 |                     "params": [
601 |                       "value"
602 |                     ],
603 |                     "type": "field"
604 |                   }
605 |                 ]
606 |               ],
607 |               "tags": []
608 |             }
609 |           ],
610 |           "title": "Last successful logins",
611 |           "transform": "table",
612 |           "type": "table"
613 |         },
614 |         {
615 |           "columns": [],
616 |           "datasource": "radius",
617 |           "editable": true,
618 |           "error": false,
619 |           "fontSize": "100%",
620 |           "id": 7,
621 |           "isNew": true,
622 |           "links": [],
623 |           "pageSize": null,
624 |           "scroll": true,
625 |           "showHeader": true,
626 |           "sort": {
627 |             "col": 0,
628 |             "desc": true
629 |           },
630 |           "span": 5.9625,
631 |           "styles": [
632 |             {
633 |               "dateFormat": "YYYY-MM-DD HH:mm:ss",
634 |               "pattern": "Time",
635 |               "type": "date"
636 |             },
637 |             {
638 |               "colorMode": null,
639 |               "colors": [
640 |                 "rgba(245, 54, 54, 0.9)",
641 |                 "rgba(237, 129, 40, 0.89)",
642 |                 "rgba(50, 172, 45, 0.97)"
643 |               ],
644 |               "decimals": 2,
645 |               "pattern": "/.*/",
646 |               "thresholds": [],
647 |               "type": "string",
648 |               "unit": "short"
649 |             }
650 |           ],
651 |           "targets": [
652 |             {
653 |               "dsType": "influxdb",
654 |               "groupBy": [
655 |                 {
656 |                   "params": [
657 |                     "$interval"
658 |                   ],
659 |                   "type": "time"
660 |                 },
661 |                 {
662 |                   "params": [
663 |                     "null"
664 |                   ],
665 |                   "type": "fill"
666 |                 }
667 |               ],
668 |               "measurement": "radius",
669 |               "query": "SELECT special_val as Ablehnungsgrund,value as Benutzer FROM \"radius\" WHERE \"type\" = 'rejected' AND special_val != '' AND $timeFilter",
670 |               "rawQuery": true,
671 |               "refId": "A",
672 |               "resultFormat": "table",
673 |               "select": [
674 |                 [
675 |                   {
676 |                     "params": [
677 |                       "value"
678 |                     ],
679 |                     "type": "field"
680 |                   }
681 |                 ]
682 |               ],
683 |               "tags": []
684 |             }
685 |           ],
686 |           "title": "Last rejects",
687 |           "transform": "table",
688 |           "type": "table"
689 |         }
690 |       ],
691 |       "title": "New row"
692 |     }
693 |   ],
694 |   "time": {
695 |     "from": "now-24h",
696 |     "to": "now"
697 |   },
698 |   "timepicker": {
699 |     "now": true,
700 |     "refresh_intervals": [
701 |       "5s",
702 |       "10s",
703 |       "30s",
704 |       "1m",
705 |       "5m",
706 |       "15m",
707 |       "30m",
708 |       "1h",
709 |       "2h",
710 |       "1d"
711 |     ],
712 |     "time_options": [
713 |       "5m",
714 |       "15m",
715 |       "1h",
716 |       "6h",
717 |       "12h",
718 |       "24h",
719 |       "2d",
720 |       "7d",
721 |       "30d"
722 |     ]
723 |   },
724 |   "templating": {
725 |     "list": []
726 |   },
727 |   "annotations": {
728 |     "list": []
729 |   },
730 |   "refresh": "30s",
731 |   "schemaVersion": 8,
732 |   "version": 44,
733 |   "links": []
734 | }


--------------------------------------------------------------------------------
/radius_functions.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | function translateAuth($t)
  3 | {
  4 |     switch($t)
  5 |     {
  6 |         case '1': return 'PAP';
  7 |         case '2': return 'CHAP';
  8 |         case '3': return 'MS-CHAP';
  9 |         case '4': return 'MS-CHAP v2';
 10 |         case '5': return 'EAP';
 11 |         case '7': return 'None';
 12 |         case '8': return 'Custom';
 13 |         default: return 'unknown: '.$t;
 14 |     }
 15 | }
 16 | 
 17 | /**
 18 | * Info from:
 19 | *  -https://technet.microsoft.com/en-us/library/cc771748(v=ws.10).aspx (Interpret NPS Database Format Log Files)
 20 | **/
 21 | function translateReason($t)
 22 | {
 23 |     switch($t)
 24 |     {
 25 |         case 0  : return 'IAS_SUCCESS';
 26 |         case 1  : return 'IAS_INTERNAL_ERROR';
 27 |         case 2  : return 'IAS_ACCESS_DENIED';
 28 |         case 3  : return 'IAS_MALFORMED_REQUEST';
 29 |         case 4  : return 'IAS_GLOBAL_CATALOG_UNAVAILABLE';
 30 |         case 5  : return 'IAS_DOMAIN_UNAVAILABLE';
 31 |         case 6  : return 'IAS_SERVER_UNAVAILABLE';
 32 |         case 7  : return 'IAS_NO_SUCH_DOMAIN';
 33 |         case 8  : return 'IAS_NO_SUCH_USER';
 34 |         case 16 : return 'IAS_AUTH_FAILURE';
 35 |         case 17 : return 'IAS_CHANGE_PASSWORD_FAILURE';
 36 |         case 18 : return 'IAS_UNSUPPORTED_AUTH_TYPE';
 37 |         case 32 : return 'IAS_LOCAL_USERS_ONLY';
 38 |         case 33 : return 'IAS_PASSWORD_MUST_CHANGE';
 39 |         case 34 : return 'IAS_ACCOUNT_DISABLED';
 40 |         case 35 : return 'IAS_ACCOUNT_EXPIRED';
 41 |         case 36 : return 'IAS_ACCOUNT_LOCKED_OUT';
 42 |         case 37 : return 'IAS_INVALID_LOGON_HOURS';
 43 |         case 38 : return 'IAS_ACCOUNT_RESTRICTION';
 44 |         case 48 : return 'IAS_NO_POLICY_MATCH';
 45 |         case 64 : return 'IAS_DIALIN_LOCKED_OUT';
 46 |         case 65 : return 'IAS_DIALIN_DISABLED';
 47 |         case 66 : return 'IAS_INVALID_AUTH_TYPE';
 48 |         case 67 : return 'IAS_INVALID_CALLING_STATION';
 49 |         case 68 : return 'IAS_INVALID_DIALIN_HOURS';
 50 |         case 69 : return 'IAS_INVALID_CALLED_STATION';
 51 |         case 70 : return 'IAS_INVALID_PORT_TYPE';
 52 |         case 71 : return 'IAS_INVALID_RESTRICTION';
 53 |         case 80 : return 'IAS_NO_RECORD';
 54 |         case 96 : return 'IAS_SESSION_TIMEOUT';
 55 |         case 97 : return 'IAS_UNEXPECTED_REQUEST';
 56 |         default: return translasteLongReason($t);
 57 |     }
 58 | }
 59 | 
 60 | /**
 61 | * Painfully parsed from
 62 | *  -https://technet.microsoft.com/en-us/library/dd197570(v=ws.10).aspx (NPS Reason Codes)
 63 | **/
 64 | function translasteLongReason($t)
 65 | {
 66 |     switch($t)
 67 |     {
 68 |         case '0': return 'The connection request was successfully authenticated and authorized by Network Policy Server.';
 69 |         case '1': return 'The connection request failed due to a Network Policy Server error.';
 70 |         case '2': return 'There are insufficient access rights to process the request.';
 71 |         case '3': return 'The Remote Authentication Dial-In User Service (RADIUS) Access-Request message that NPS received from the network access server was malformed.';
 72 |         case '4': return 'The NPS server was unable to access the Active Directory Domain Services (AD DS) global catalog. Because of this, authentication and authorization for the connection request cannot be performed, and access is denied.';
 73 |         case '5': return 'The Network Policy Server was unable to connect to a domain controller in the domain where the user account is located. Because of this, authentication and authorization for the connection request cannot be performed, and access is denied.';
 74 |         case '6': return 'The NPS server is unavailable. This issue can occur if the NPS server is running low on or is out of random access memory (RAM). It can also occur if the NPS server fails to receive the name of a domain controller, if there is a problem with the Security Accounts Manager (SAM) database on the local computer, or in circumstances where there is a Windows NT directory service (NTDS) failure.';
 75 |         case '7': return 'The domain that is specified in the User-Name attribute of the RADIUS message does not exist.';
 76 |         case '8': return 'The user account that is specified in the User-Name attribute of the RADIUS message does not exist.';
 77 |         case '9': return 'An Internet Authentication Service (IAS) extension dynamic link library (DLL) that is installed on the NPS server discarded the connection request.';
 78 |         case '10': return 'An IAS extension dynamic link library (DLL) that is installed on the NPS server has failed and cannot perform its function.';
 79 |         case '16': return 'Authentication failed due to a user credentials mismatch. Either the user name provided does not match an existing user account or the password was incorrect.';
 80 |         case '17': return 'The user\'s attempt to change their password has failed.';
 81 |         case '18': return 'The authentication method used by the client computer is not supported by Network Policy Server for this connection.';
 82 |         case '19': return 'Challenge Handshake Authentication Protocol (CHAP) is being used as the authentication method for the connection request, however CHAP is not configured to store a reversibly encrypted form of user passwords.
 83 |         With CHAP, reversibly encrypted password storage is required. You can enable reversibly encrypted password storage per user account or for all accounts in a domain using Group Policy. To enable reversibly encrypted password storage for a user account, obtain the properties of a user account in AD DS, click the Account tab, and then select the Store password using reversible encryption check box.
 84 |         To allow reversibly encrypted password storage for all user accounts in the domain, add the Group Policy Management Editor snap-in to the Microsoft Management Console (MMC) and enable the default domain policy setting Store password using reversible encryption at the following path: Computer Configuration | Policies | Windows Settings | Security Settings | Account Policies | Password Policies.';
 85 |         case '20': return 'The client attempted to use LAN Manager authentication, which is not supported by Network Policy Server. To enable the use of LAN Manager authentication, see NPS: LAN Manager Authentication.';
 86 |         case '21': return 'An IAS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request.';
 87 |         case '22': return 'Network Policy Server was unable to negotiate the use of an Extensible Authentication Protocol (EAP) type with the client computer.';
 88 |         case '23': return 'An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors. By default, these log files are located at %windir%\System32\Logfiles.';
 89 |         case '32': return 'NPS is joined to a workgroup and performs the authentication and authorization of connection requests using the local Security Accounts Manager database, however the Access-Request message contains a domain user name. NPS does not have access to a domain user accounts database. The connection request was denied.';
 90 |         case '33': return 'The user that is attempting to connect to the network must change their password.';
 91 |         case '34': return 'The user account that is specified in the RADIUS Access-Request message is disabled.';
 92 |         case '35': return 'The user account that is specified in the RADIUS Access-Request message is expired.';
 93 |         case '36': return 'The user\'s authentication attempts have exceeded the maximum allowed number of failed attempts specified by the Account lockout threshold setting in Account Lockout Policy in Group Policy. To unlock the account, obtain the user account properties in the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, click the Account tab, and then click Unlock account.';
 94 |         case '37': return 'According to AD DS user account logon hours, the user is not permitted to access the network on this day and time. To change the account logon hours, obtain the user account properties in the Active Directory Users and Computers snap-in, click the Account tab, and then click Logon Hours. In the Logon Hours dialog box, configure the days and times when the user is permitted to access the network.';
 95 |         case '38': return 'Authentication failed due to a user account restriction or requirement that was not followed. For example, the user account settings might require the use of a password but the user attempted to log on with a blank password. To resolve this issue, check the user account properties for restrictions, and then either remove or modify the restrictions or inform the user of the requirements for network access.';
 96 |         case '48': return 'The connection request did not match a configured network policy, so the connection request was denied by Network Policy Server.';
 97 |         case '49': return 'The connection request did not match a configured connection request policy, so the connection request was denied by Network Policy Server.';
 98 |         case '64': return 'Remote Access Account Lockout is enabled, and the user\'s authentication attempts have exceeded the designated lockout count because the credentials they supplied (\';user name and password) are not valid. When the lockout count for a user account is reset to 0 due to either a successful authentication or an automatic reset, the registry subkey for the user account is deleted. To manually reset a user account that has been locked out before the failed attempts counter is automatically reset, delete the following registry subkey that corresponds to the user\'s account name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout\domain name:user name';
 99 |         case '65': return 'The Network Access Permission setting in the dial-in properties of the user account is set to Deny access to the user.
100 |         To change the Network Access Permission setting to either Allow access or Control access through NPS Network Policy, obtain the properties of the user account in the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, click the Dial-in tab, and then change Network Access Permission.';
101 |         case '66': return 'Authentication failed. Either the client computer attempted to use an authentication method that is not enabled on the matching network policy or the client Computer attempted to authenticate as Guest, but guest authentication is not enabled. To resolve this issue, ensure that all client computers are configured to use one or more authentication methods that are allowed by matching network policies.';
102 |         case '67': return 'NPS denied the connection request because the value of the Calling-Station-ID attribute in the Access-Request message did not match the value of Verify Caller ID in user account dial-in properties in the Active Directory Users and Computers snap-in.';
103 |         case '68': return 'The user or computer does not have permission to access the network on this day at this time. To change the day and time when the user is permitted to connect to the network, change the Day and Time Restrictions in the constraints of the matching network policy. For more information, see Constraints Properties.';
104 |         case '69': return 'The telephone number of the network access server does not match the value of the Calling-Station-ID attribute that is configured in the constraints of the matching network policy. NPS denied the Access-Request message.';
105 |         case '70': return 'The network access method used by the access client to connect to the network does not match the value of the NAS-Port-Type attribute that is configured in the constraints of the matching network policy. NPS denied the Access-Request message.';
106 |         case '72': return 'The user password has expired or is about to expire and the user must change their password, however Authentication Methods in network policy constraints are not configured to allow the user to change their password. To allow the user to change their password, open the properties of the matching network policy, click the Constraints tab, click Authentication Methods, and then in the details pane select the appropriate authentication method and User can change password after it has expired check box.';
107 |         case '73': return 'The purposes that are configured in the Application Policies extensions, also called Enhanced Key Usage (EKU) extensions, section of the user or computer certificate are not valid or are missing. The user or computer certificate must be configured with the Client Authentication purpose in Application Policies extensions. The object identifier for Client Authentication is 1.3.6.1.5.5.7.3.2. To correct this problem, you must reconfigure the certificate template with the Client Authentication purpose in Application Policies extensions, revoke the old certificate, and enroll a new certificate that is configured correctly. For more information, see Foundation Network Companion Guide: Deploying Computer and User Certificates at http://go.microsoft.com/fwlink/?LinkId=113884.';
108 |         case '80': return 'NPS attempted to write accounting data to the data store (a log file on the local computer or a SQL Server database), but failed to do so for unknown reasons.';
109 |         case '96': return 'Authentication failed due to an Extensible Authentication Protocol (EAP) session timeout; the EAP session with the access client was incomplete.';
110 |         case '97': return 'The authentication request was not processed because it contained a Remote Authentication Dial-In User Service (RADIUS) message that was not appropriate for the secure authentication transaction.';
111 |         case '112': return 'The local NPS proxy server forwarded a connection request to a remote RADIUS server, and the remote server rejected the connection request. Check the event log on the remote RADIUS server to determine the reason that the connection request was rejected.';
112 |         case '113': return 'The local NPS proxy attempted to forward a connection request to a member of a remote RADIUS server group that does not exist. To resolve this issue, configure a valid remote RADIUS server group.';
113 |         case '115': return 'The local NPS proxy did not forward a RADIUS message because it is not an accounting request or a connection request.';
114 |         case '116': return 'The local NPS proxy server cannot forward the connection request to the remote RADIUS server because either the proxy cannot open a Windows socket over which to send the connection request, or the proxy server attempted to send the connection request but received Windows sockets errors that prevented successful completion of the send operation.';
115 |         case '117': return 'The remote RADIUS server did not respond to the local NPS proxy within an acceptable time period. Verify that the remote RADIUS server is available and functioning properly.';
116 |         case '118': return 'The local NPS proxy server received a RADIUS message that is malformed from a remote RADIUS server, and the message is unreadable. This issue can also be caused if a connection request contains more than the expected number of User-Name attributes, or if the User-Name attribute value is not valid, such as if the value has zero length or if it contains characters that are not valid.';
117 |         case '256': return 'The certificate provided by the user or computer as proof of their identity is a revoked certificate. Because of this, the user or computer was not Authenticated, and NPS rejected the connection request.';
118 |         case '257': return 'Due to a missing dynamic link library (DLL) or exported function, NPS cannot access the certificate revocation list to verify whether the user or client computer certificate is valid or is revoked.';
119 |         case '258': return 'NPS cannot access the certificate revocation list to verify whether the user or client computer certificate is valid or is revoked. Because of this, authentication failed.';
120 |         case '259': return 'The certification authority that manages the certificate revocation list is not available. NPS cannot verify whether the certificate is valid or is revoked. Because of this, authentication failed.';
121 |         case '260': return 'The Extensible Authentication Protocol (EAP) message has been altered so that the Message Digest 5 (MD5) hash of the entire Remote Authentication Dial-In User Service (RADIUS) message does not match, or the message has been altered at the Schannel level.';
122 |         case '261': return 'NPS cannot contact Active Directory Domain Services (AD DS) or the local user accounts database to perform authentication and authorization. The connection request is denied for this reason.';
123 |         case '262': return 'NPS discarded the RADIUS message because it is incomplete and the signature was not verified.';
124 |         case '263': return 'NPS did not receive complete credentials from the user or computer. The connection request is denied for this reason.';
125 |         case '264': return 'The Security Support Provider Interface (SSPI) called by EAP reports that the system clocks on the NPS server and the access client are not synchronized.';
126 |         case '265': return 'The certificate that the user or client computer provided to NPS as proof of identity chains to an enterprise root certification authority that is not trusted by the NPS server.';
127 |         case '266': return 'NPS received a message that was either unexpected or incorrectly formatted. NPS discarded the message for this reason.';
128 |         case '267': return 'The certificate provided by the connecting user or computer is not valid because it is not configured with the Client Authentication purpose in Application Policies or Enhanced Key Usage (EKU) extensions. NPS rejected the connection request for this reason.';
129 |         case '268': return 'The certificate provided by the connecting user or computer is expired. NPS rejected the connection request for this reason.';
130 |         case '269': return 'The Security Support Provider Interface (SSPI) called by EAP reports that the NPS server and the access client cannot communicate because they do not possess a common algorithm.';
131 |         case '270': return 'Based on the matching NPS network policy, the user is required to log on with a smart card, but they have attempted to log on by using other credentials. NPS rejected the connection request for this reason.';
132 |         case '271': return 'The connection request was not processed because the NPS server was in the process of shutting down or restarting when it received the request.';
133 |         case '272': return 'The certificate that the user or client computer provided to NPS as proof of identity maps to multiple user or computer accounts rather than one account. NPS rejected the connection request for this reason.';
134 |         case '273': return 'Authentication failed. NPS called Windows Trust Verification Services, and the trust provider is not recognized on this computer. A trust provider is a software module that implements the algorithm for application-specific policies regarding trust.';
135 |         case '274': return 'Authentication failed. NPS called Windows Trust Verification Services, and the trust provider does not support the specified action. Each trust provider provides its own unique set of action identifiers. For information about the action identifiers supported by a trust provider, see the documentation for that trust provider.';
136 |         case '275': return 'Authentication failed. NPS called Windows Trust Verification Services, and the trust provider does not support the specified form. A trust provider is a software module that implements the algorithm for application-specific policies regarding trust. Trust providers support subject forms that describe where the trust information is located and what trust actions to take regarding the subject.';
137 |         case '276': return 'Authentication failed. NPS called Windows Trust Verification Services, but the binary file that calls EAP cannot be verified and is not trusted.';
138 |         case '277': return 'Authentication failed. NPS called Windows Trust Verification Services, but the binary file that calls EAP is not signed, or the signer certificate cannot be found';
139 |         case '278': return 'Authentication failed. The certificate that was provided by the connecting user or computer is expired.';
140 |         case '279': return 'Authentication failed. The certificate is not valid because the validity periods of certificates in the chain do not match. For example, the following End Certificate and Issuer Certificate validity periods do not match: End Certificate validity period: 2007-2010; Issuer Certificate validity period: 2006-2008.';
141 |         case '280': return 'Authentication failed. The certificate is not valid and was not issued by a valid certification authority (CA).';
142 |         case '281': return 'Authentication failed. The path length constraint in the certification chain has been exceeded. This constraint restricts the maximum number of CA certificates that can follow this certificate in the certificate chain.';
143 |         case '282': return 'Authentication failed. The certificate contains a critical extension that is unrecognized by NPS.';
144 |         case '283': return 'Authentication failed. The certificate does not contain the Client Authentication purpose in Application Policies extensions, and cannot be used for authentication.';
145 |         case '284': return 'Authentication failed. The certificate is not valid because the certificate issuer and the parent of the certificate in the certificate chain are required to match but do not match.';
146 |         case '285': return 'Authentication failed. NPS cannot locate the certificate, or the certificate is incorrectly formed and is missing important information.';
147 |         case '286': return 'Authentication failed. The certificate provided by the connecting user or computer is issued by a certification authority (CA) that is not trusted by the NPS server.';
148 |         case '287': return 'Authentication failed. The certificate provided by the connecting user or computer does not chain to an enterprise root CA that NPS trusts.';
149 |         case '288': return 'Authentication failed due to an unspecified trust failure.';
150 |         case '289': return 'Authentication failed. The certificate provided by the connecting user or computer is revoked and is not valid.';
151 |         case '290': return 'Authentication failed. A test or trial certificate is in use, however the test root CA is not trusted, according to local or domain policy settings.';
152 |         case '291': return 'Authentication failed because NPS cannot locate and access the certificate revocation list to verify whether the certificate has or has not been revoked. This issue can occur if the revocation server is not available or if the certificate revocation list cannot be located in the revocation server database.';
153 |         case '292': return 'Authentication failed. The value of the User-Name attribute in the connection request does not match the value of the common name (CN) property in the certificate.';
154 |         case '293': return 'Authentication failed. The certificate provided by the connecting user or computer is not valid because it is not configured with the Client Authentication purpose in Application Policies or Enhanced Key Usage (EKU) extensions. NPS rejected the connection request for this reason.';
155 |         case '294': return 'Authentication failed because the certificate was explicitly marked as untrusted by the Administrator. Certificates are designated as untrusted when they are imported into the Untrusted Certificates folder in the certificate store for the Current User or Local Computer in the Certificates Microsoft Management Console (MMC) snap-in.';
156 |         case '295': return 'Authentication failed. The certificate provided by the connecting user or computer is issued by a CA that is not trusted by the NPS server.';
157 |         case '296': return 'Authentication failed. The certificate provided by the connecting user or computer is not valid because it is not configured with the Client Authentication purpose in Application Policies or Enhanced Key Usage (EKU) extensions. NPS rejected the connection request for this reason.';
158 |         case '297': return 'Authentication failed. The certificate provided by the connecting user or computer is not valid because it does not have a valid name.';
159 |         case '298': return 'Authentication failed. Either the certificate does not contain a valid user principal name (UPN) or the value of the User-Name attribute in the connection request does not match the certificate.';
160 |         case '299': return 'Authentication failed. The sequence of information provided by internal components or protocols during message verification is incorrect.';
161 |         case '300': return 'Authentication failed. The certificate is malformed and Extensible Authentication Protocl (EAP) cannot locate credential information in the certificate.';
162 |         case '301': return 'NPS terminated the authentication process. NPS received a cryptobinding type length value (TLV) from the access client that is not valid. This issue occurs when an attempt to breach your network security has occurred and a man-in-the-middle (MITM) attack is in progress. During MITM attacks on your network, attackers use unauthorized computers to intercept traffic between your legitimate hosts while posing as one of the legitimate hosts. The attacker\'s computer attempts to gain data from your other network resources. This enables the attacker to use the unauthorized computer to intercept, decrypt, and access all network traffic that would otherwise go to one of your legitimate network resources.';
163 |         case '302': return 'NPS terminated the authentication process. NPS did not receive a required cryptobinding type length value (TLV) from the access client during the authentication process.';
164 |     }
165 | }
166 | 
167 | /**
168 | * Info from:
169 | *  -http://www.cisco.com/c/en/us/td/docs/net_mgmt/access_registrar/1-7/concepts/guide/radius.html (http://www.cisco.com/c/en/us/td/docs/net_mgmt/access_registrar/1-7/concepts/guide/radius.html)
170 | *  -https://technet.microsoft.com/en-us/library/cc771748(v=ws.10).aspx (Interpret NPS Database Format Log Files)
171 | *  -https://technet.microsoft.com/en-us/library/cc958030.aspx (RADIUS Packet Format)
172 | **/
173 | function translatePackageType($t)
174 | {
175 |     switch($t)
176 |     {
177 |         case '1': return 'Request';     //sent by the client (NAS) requesting access
178 |         case '2': return 'Accepted ';   //sent by the RADIUS server allowing access
179 |         case '3': return 'Rejected';    //sent by the RADIUS server rejecting access
180 |         case '4': return 'Accounting-Request';  //sent by the client (NAS) requesting accounting
181 |         case '5': return 'Accounting-Response'; //sent by the RADIUS server acknowledging accounting
182 |         case '11': return 'Access-Challenge'; //sent by the RADIUS server requesting more information in order to allow access. The NAS, after communicating with the user, responds with another Access-Request.
183 |         case '12': return 'Status-Server';
184 |         case '13': return 'Status-Client';
185 |         case '255': return 'Reserved';
186 | 
187 |         default: return 'unknown: '.$t;
188 |     }
189 | }


--------------------------------------------------------------------------------