MonsterOps logo MonsterOps
Docs / Monitoring / Logs

Logs

Overview

Logs covers two things: the authentication log (every Accept/Reject FreeRADIUS records in radpostauth, with analytics) and access to the raw FreeRADIUS log file. This is where you go first when "a user can't connect."

Where things are

  • Auth Logs — the radpostauth viewer: filter by Accept / Reject, see latency, and — with GeoIP enabled — a flag + city per client IP. Anomaly banners flag concurrent sessions, unusual hours, and multi-NAS roaming.
  • FreeRADIUS log — the raw radius.log, viewable under Health → Logs or the Server Console RADIUS Log tab. Paths come from MONSTEROPS_RADIUS_LOG_FILES.

Common tasks

  • Find why a login failed — filter Auth Logs to Reject and locate the user; the reason and timing narrow it down, then confirm against the raw FreeRADIUS log.
  • Spot suspicious activity — watch the anomaly banners (odd hours, many concurrent sessions, roaming across NAS devices).
  • Tail the RADIUS log live — open the Server Console → RADIUS Log (if the console is enabled), or on the host:
sudo tail -f /var/log/freeradius/radius.log

Application, RADIUS, and database logs

When something breaks there are three sources — include at least one in a bug report:

# MonsterOps application log (systemd)
sudo journalctl -u monsterops -f
sudo journalctl -u monsterops -n 200 --no-pager

# FreeRADIUS log
sudo tail -f /var/log/freeradius/radius.log

# PostgreSQL log (useful for 500s blamed on a query)
sudo tail -f /var/log/postgresql/postgresql-*.log

Problems you may hit

  • Auth Logs empty — FreeRADIUS isn't writing radpostauth (post-auth SQL logging not enabled), or it's pointed at a different database.
  • No geo / flags — GeoIP isn't configured; upload a GeoLite2 database under Integrations or set MONSTEROPS_GEOIP_DB.
  • RADIUS log tab shows nothing — the path in MONSTEROPS_RADIUS_LOG_FILES doesn't match where your FreeRADIUS writes; correct it in Configuration.
  • Log grows forever — the scheduled Log Retention job prunes radpostauth and other tables; tune the retention windows in Configuration.
  • Sessions — what happened after a successful auth
  • Health — the log viewer and server console
  • Integrations — GeoIP for the auth log