tutorial

Monitoring FreeRADIUS with Vigilmon

FreeRADIUS powers Wi-Fi, VPN, and wired network authentication for millions of networks. Here's how to monitor authentication availability, EAP health, backend database connectivity, and CoA service with Vigilmon.

FreeRADIUS is the world's most widely deployed RADIUS server, handling authentication, authorization, and accounting (AAA) for Wi-Fi networks, VPN gateways, and enterprise wired infrastructure. When FreeRADIUS goes down, users can't connect — laptops stay offline, VPN tunnels drop, and support tickets flood in. Vigilmon gives you continuous monitoring of the authentication service, backend database connectivity, EAP module health, and CoA endpoints, so you find failures before your users do.

What You'll Set Up

  • RADIUS authentication service availability (port 1812)
  • RADIUS accounting service availability (port 1813)
  • CoA (Change of Authorization) service health (port 1814)
  • SQL/LDAP backend database connectivity
  • EAP module health monitoring via the status server
  • Certificate store and TLS handshake service
  • Access-accept/access-reject ratio via heartbeat reporting
  • Module load status via the FreeRADIUS status server

Prerequisites

  • FreeRADIUS 3.x or 4.x running on Linux
  • The FreeRADIUS status virtual server enabled (ships with most distros, disabled by default)
  • radtest command-line tool installed (freeradius-utils package)
  • A free Vigilmon account

Step 1: Enable the FreeRADIUS Status Server

FreeRADIUS ships with a status virtual server that accepts RADIUS requests and returns server statistics. Enable it to get a proper liveness probe:

# Enable the status site
ln -s /etc/freeradius/3.0/sites-available/status \
      /etc/freeradius/3.0/sites-enabled/status

# Restart FreeRADIUS
systemctl restart freeradius

The status server listens on 127.0.0.1:18121 by default and accepts a single test user (admin with password admin). Verify it works:

radtest -t mschapv2 admin admin 127.0.0.1:18121 0 adminsecret

You should see Access-Accept. If you see Access-Reject or a timeout, check /var/log/freeradius/radius.log.

Step 2: Monitor RADIUS Authentication Port (1812)

The primary RADIUS authentication port is the most critical service to monitor. Use a TCP port check for a lightweight, always-on availability probe:

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to TCP Port.
  3. Host: your FreeRADIUS server IP or hostname.
  4. Port: 1812
  5. Check interval: 1 minute
  6. Click Save.

A TCP connect failure means FreeRADIUS is down or unreachable from the network. This is your highest-severity alert.

Step 3: Monitor RADIUS Accounting Port (1813)

Accounting failures are less immediately visible than authentication failures but cause billing gaps and session tracking problems:

  1. Add Monitor → TCP Port.
  2. Host: your FreeRADIUS server IP.
  3. Port: 1813
  4. Check interval: 2 minutes
  5. Save.

Step 4: Monitor the CoA Port (1814)

Change of Authorization (CoA) lets network equipment dynamically modify active sessions — used for bandwidth throttling, VLAN changes, and forced disconnects. If the CoA port is down, your NOC loses the ability to act on active sessions:

  1. Add Monitor → TCP Port.
  2. Host: your FreeRADIUS server IP.
  3. Port: 1814
  4. Check interval: 5 minutes
  5. Save.

Step 5: Monitor the Status Server (Deep Health Check)

The status server reports FreeRADIUS internals. Use a script-based heartbeat to perform an actual RADIUS authentication against the status server and ping Vigilmon only on success:

Create the heartbeat

  1. Click Add Monitor → Heartbeat.
  2. Name: FreeRADIUS status server auth
  3. Grace period: 3 minutes
  4. Copy the heartbeat URL.

Create the check script

# /usr/local/bin/check-freeradius.sh
#!/bin/bash
set -e

HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_HEARTBEAT_TOKEN"

# Run radtest against the status server
result=$(radtest -t mschapv2 admin admin 127.0.0.1:18121 0 adminsecret 2>&1)

if echo "$result" | grep -q "Access-Accept"; then
  curl -s "$HEARTBEAT_URL"
fi

chmod +x /usr/local/bin/check-freeradius.sh

Schedule it

# /etc/cron.d/freeradius-check
* * * * * root /usr/local/bin/check-freeradius.sh

If radtest returns Access-Reject or times out, the heartbeat isn't pinged and Vigilmon alerts you after the grace period.

Step 6: Monitor SQL/LDAP Backend Connectivity

FreeRADIUS typically connects to a SQL database (MySQL, PostgreSQL) or LDAP directory to look up users. A dead database means every authentication fails with a generic error. Monitor the backend independently:

MySQL / MariaDB

  1. Add Monitor → TCP Port.
  2. Host: your database server.
  3. Port: 3306
  4. Check interval: 2 minutes
  5. Name: MySQL (FreeRADIUS backend)
  6. Save.

PostgreSQL

Same steps, port 5432.

LDAP

  1. Add Monitor → TCP Port.
  2. Port: 389 (plain) or 636 (LDAPS).
  3. Check interval: 2 minutes
  4. Save.

When the backend monitor goes red and RADIUS authentication simultaneously fails, you know the root cause immediately without needing to SSH into the server.

Step 7: Monitor TLS Certificate Health

EAP-TLS, EAP-PEAP, and EAP-TTLS all depend on the FreeRADIUS server certificate. An expired certificate breaks all certificate-based authentication silently. Monitor the certificate expiry:

  1. Add Monitor → SSL Certificate.
  2. Host: your FreeRADIUS server (or the hostname in your server certificate CN/SAN).
  3. Port: 443 (if you expose an HTTPS management interface) — or use a dedicated cert-expiry check if your Vigilmon plan supports raw certificate monitoring.
  4. Alert X days before expiry: 30
  5. Save.

For environments where the RADIUS server isn't directly exposed over HTTPS, add a calendar reminder to rotate the certificate 30 days before expiry and note the expiry date in the monitor description.

Step 8: Heartbeat for Access-Accept/Reject Ratio Reporting

A high reject rate often precedes or accompanies backend failures — it's an early-warning signal. Add a heartbeat monitor that a cron script only pings when the ratio is within acceptable bounds:

# /usr/local/bin/check-radius-ratio.sh
#!/bin/bash
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_RATIO_HEARTBEAT_TOKEN"
MAX_REJECT_PCT=20  # Alert if >20% of requests are rejected

# Query FreeRADIUS status (requires unlang Status-Server support)
accepts=$(radclient -q 127.0.0.1:18121 status adminsecret \
  'FreeRADIUS-Statistics-Type = 1' 2>/dev/null | \
  grep "FreeRADIUS-Total-Access-Accepts" | awk '{print $3}')

rejects=$(radclient -q 127.0.0.1:18121 status adminsecret \
  'FreeRADIUS-Statistics-Type = 1' 2>/dev/null | \
  grep "FreeRADIUS-Total-Access-Rejects" | awk '{print $3}')

total=$((accepts + rejects))
if [ "$total" -gt 0 ]; then
  reject_pct=$(( rejects * 100 / total ))
  if [ "$reject_pct" -lt "$MAX_REJECT_PCT" ]; then
    curl -s "$HEARTBEAT_URL"
  fi
fi

Run this every 5 minutes via cron. If the reject rate spikes above your threshold, the heartbeat stops pinging and Vigilmon alerts you.

Step 9: Configure Alerting

  1. In Vigilmon, go to Settings → Notifications.
  2. Add your alert channel: email, Slack, PagerDuty, or webhook.
  3. For port 1812 (authentication), set alert after 1 failed check — every missed authentication is user-facing.
  4. For the backend database monitors, set alert after 2 failed checks.
  5. For accounting (1813) and CoA (1814), set alert after 2 failed checks.
  6. Enable recovery notifications so your NOC knows when service restores.

Key Metrics to Watch

| Signal | Monitor Type | Alert Threshold | |---|---|---| | Auth port 1812 | TCP | 1 failure | | Accounting port 1813 | TCP | 2 failures | | CoA port 1814 | TCP | 2 failures | | Status server Access-Accept | Heartbeat | Grace period exceeded | | MySQL/PostgreSQL backend | TCP | 2 failures | | LDAP directory | TCP | 2 failures | | Server TLS certificate | SSL cert | 30 days before expiry | | Accept/reject ratio | Heartbeat | Grace period exceeded |

Conclusion

FreeRADIUS is infrastructure — silent when healthy, catastrophic when it fails. With Vigilmon you get port-level availability checks, deep authentication probes via the status server, backend database monitoring, and certificate expiry alerts all in one dashboard. When your Wi-Fi or VPN authentication breaks, you'll know within minutes instead of waiting for the help desk queue to fill up.

Sign up for Vigilmon — free tier covers all the monitors in this tutorial.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles