file

Stores the captured RADIUS messages in a file. The file type is PcapNG.

Example configuration of file captures:

captures {
    capture "CAPTURE_TO_DIRECTORY" {
        file {
            directory "/var/lib/radiator/captures";
        }
    }

    capture "CAPTURE_TO_FILE" {
        file {
            directory "/var/lib/radiator/captures";
            filename "radiator-server.pcap";
        }
    }
}

When using file capture destination, you can configure the output location using the following parameters:

• directory: Specifies where capture files should be stored.
• filename: Specifies the exact filename for the capture file. If not specified, a filename will be automatically generated. The automatically generated filename is named context_id.pcapng where context_id is the value of authentication context ID that can be logged, for example, in the authentication log.

When troubleshooting authentication issues, you can correlate authentication log entries with their corresponding capture files using the Context-Id. This example takes the last entry from a JSON formatted authentication log and uses the jq command to extract the value of Context-Id key.

% sudo tail -1 radiator-server-authentication.log | jq -r '.["Context-Id"]'
abc123def456789a
% sudo ls -l /var/lib/radiator/captures/abc123def456789a.pcapng
-rw-r----- 1 radiator radiator 41256 Jun  5 09:23 /var/lib/radiator/captures/abc123def456789a.pcapng