[tac_plus] Re: tac_plus problem

[john heasley]

> Jun  2 14:44:59.065: TPLUS: Accounting request created for 347933(rish)
> Jun  2 14:44:59.065: TPLUS(00054F1D)/0/NB_WAIT/66461874: Started 5 sec timeout
> Jun  2 14:44:59.069: TPLUS(00054F1D)/0/NB_WAIT: socket event 2
> Jun  2 14:44:59.069: TPLUS(00054F1D)/0/NB_WAIT: wrote 536 bytes
> 5w6d: %LINK-3-UPDOWN: Interface Virtual-Access62, changed state to down
> 5w6d: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access62, changed state to down
> 
> 
> And here is what we get in log of tac_plus:
> 
> Tue Jun  2 17:42:06 2009 [10010]: session.peerip is 89.184.0.121
> Tue Jun  2 17:42:06 2009 [10010]: session request from 89.184.0.121 sock=2
> Tue Jun  2 17:42:06 2009 [46296]: connect from 89.184.0.121 [89.184.0.121]
> Tue Jun  2 17:42:06 2009 [46296]: Waiting for packet
> Tue Jun  2 17:42:11 2009 [46296]: 89.184.0.121 : fd 2 eof (connection closed)
> Tue Jun  2 17:42:11 2009 [46296]: Error 89.184.0.121: start_session:
> bad socket read
> 
> This time tac_plus logs nothing in accounting log

I suspect that this is not a tac_plus problem, rather router bug.  It would
seem that the router abruptly closes the connection before the accounting
record is received.  You could verify this with tcpdump to collect the
packets and look for the FIN relative to the others.  It should wait for an
acknowledgement from the server.