show network-access aaa statistics

Requests received

• Number of accounting requests generated by the AAA framework.

• Number of dynamic requests received from the external server.

Does not include requests sent from backup accounting.

Accounting request failures

Number of accounting requests that failed to be sent or queued from a client to a RADIUS accounting server.

Does not include requests sent from backup accounting.

Accounting request success

Number of accounting requests successfully sent or queued from a client to a RADIUS accounting server.

Does not include requests sent from backup accounting.

Account on requests

Number of accounting on requests sent from a client to a RADIUS accounting server.

Accounting start requests

Number of accounting start requests sent from a client to a RADIUS accounting server.

Accounting interim requests

Number of accounting interim requests sent from a client to a RADIUS accounting server.

Accounting stop requests

Number of accounting stop requests sent from a client to a RADIUS accounting server.

Does not include requests sent from backup accounting.

Accounting request timeouts

Number of accounting requests to the accounting server that timed out. This field was named Timed out requests in releases before Junos OS Release 16.1.

Does not include requests sent from backup accounting.

Accounting Response failures

Number of accounting requests not acknowledged (NAK) by the accounting server.

Does not include requests sent from backup accounting.

Accounting response success

Number of accounting requests acknowledged by the accounting server.

Does not include requests sent from backup accounting.

Account on responses

Number of accounting on requests acknowledged by the RADIUS accounting server.

Accounting start responses

Number of accounting start requests acknowledged by the RADIUS accounting server.

Accounting interim responses

Number of accounting interim requests acknowledged by the RADIUS accounting server.

Accounting stop responses

Number of accounting stop requests acknowledged by the RADIUS accounting server.

Does not include requests sent from backup accounting.

Accounting rollover requests

Number of accounting requests coming to a RADIUS accounting server after a previous server timing out.

Accounting unknown requests

Number of unknown accounting requests sent from a client to a RADIUS accounting server (for example, when the header has invalid or unsupported information).

Accounting radius pending requests

Number of accounting requests sent from a client to a RADIUS accounting server that are waiting for a response from the server.

Accounting malformed responses

Number of accounting responses from a RADIUS accounting server that have invalid or unexpected attributes.

Accounting retransmissions

Number of accounting requests made by a client to the RADIUS sever that were retransmitted.

Does not include requests sent from backup accounting.

Accounting bad authenticators

Number of accounting responses from a RADIUS accounting server that have an incorrect authenticator (for example, the client and server RADIUS secret do not match).

Accounting packets dropped

Number of accounting responses from a RADIUS accounting server that are dropped by a client.

Accounting backup record creation requests

Number of accounting stop requests from a client to a RADIUS accounting server that were forwarded to be backed up.

Accounting backup replay request success

Number of backup accounting stop requests successfully created by clients after each timeout for replay to a RADIUS accounting server.

Accounting backup request failures

Number of backup accounting requests that failed to be sent or queued from a client to a RADIUS accounting server.

Accounting backup request success

Number of backup accounting requests successfully sent or queued from a client to a RADIUS accounting server.

Accounting backup timeouts

Number of backup accounting requests that timed out after being sent to a RADIUS accounting server.

Accounting backup in-flight requests

Number of backup accounting requests that were successfully sent or queued to a RADIUS accounting server for which no response or error has been received yet.

Backup requests are replayed only in the following circumstances:

• When the request being replayed receives a positive response, the next request can be replayed.

• When the request being replayed receives a timeout response, it can be replayed again.

Consequently this intermediate timer displays 1 or 0. The value eventually drops to 0 as requests are responded to positively or fail due to error.

Accounting backup responses success

Number of backup records that were successfully acknowledged with a positive response from a RADIUS accounting server.

Accounting backup radius requests

Number of backup requests sent to UDP level.

This is a RADIUS-level counter and increments rapidly based on the configured retries and timeouts and the RADIUS-level retransmissions. An observation that the value is increasing is more significant than the exact value of the counter.

Accounting backup radius responses

Number of responses received at the UDP level for backup requests.

This is a RADIUS-level counter and increments rapidly based on the configured retries and timeouts and the RADIUS-level retransmissions. Observation that the value is increasing is more significant than the exact value of the counter.

Accounting backup radius timeouts

Number of backup requests that timed out after being sent to UDP.

This is a RADIUS-level counter and increments rapidly based on the configured retries and timeouts and the RADIUS-level retransmissions. Observation that the value is increasing is more significant than the exact value of the counter.

Accounting backup radius pending requests

Number of backup requests sent to a RADIUS accounting server that are waiting for a response from the server.

This is an intermediate state counter that eventually drops to zero as requests are responded to or failed due to error.

Accounting backup radius retransmissions

Sum of backup request retransmissions for each RADIUS accounting server.

This is a RADIUS-level counter and increments rapidly based on the configured retries and timeouts and the RADIUS-level retransmissions. Observation that the value is increasing is more significant than the exact value of the counter.

Accounting backup malformed responses

Sum of malformed responses received for backup requests sent to each RADIUS accounting server at the UDP level.

Accounting backup bad authenticators

Sum of responses received for backup accounting requests for each RADIUS accounting server where authenticators were mismatched.

Accounting backup responses dropped

Sum of responses for backup accounting requests for each RADIUS accounting server that were dropped due to various sanity checks.

Accounting backup rollover requests

Sum of backup accounting requests rolled over for each RADIUS accounting server.

Accounting backup unknown responses

Sum of unknown responses for backup accounting requests for each RADIUS accounting server.

Client

Client type; for example, DHCP, Mobile IP, PPP.

Out of Memory

Number of times an address was not given to the client due to memory issues.

No Matches

Number of times there were no network matches for the pool.

Pool Name

Name of the address-assignment pool for this client.

Out of Addresses

Number of times there were no available addresses in the pool.

Address total

Number of addresses in the pool.

Addresses in use

Number of addresses in use.

Addresses excluded

Number of addresses excluded from being allocated from the pool with the excluded-address or excluded-range statements.

Address Usage (percent)

Percentage of total addresses in use. This value does not take excluded addresses into account.

Assertion attributes missing

Number of SAML assertions where mandatory attributes like username configured at the identity-provider object are not present in the assertion.

Assertion decryption fail

Instances where the identity provider (IdP) could not decrypt the assertion it had encrypted in SAML.

Assertion node missing

Instances when the SAML assertion or the encrypted-assertion node is missing in the assertion response.

Assertion parse fail

Instances when the firewall failed to parse SAML assertion.

Assertion received

Number of SAML assertion responses received from IdP.

Assertion sanity fail

Instances when the issuer node value failed the sanity checks because it does not match the configured IdP entity-id in SAML.

Assertion signature verify fail

Count of SAML assertion message signature verification failures.

Assertion timeout

Number of requests that did not receive a response from the IdP before the assertion wait time expired in SAML.

Assertion username mismatch

Instances when the username differs in the authentication request and the assertion response in SAML.

Authentication request received

Number of SAML-based authentication requests received.

Authentication response sent

Number of authentication responses sent in SAML.

Logout parse fail

Instances of failures in parsing in the logout request message in SAML.

Logout request received

Number of user logout requests received from the IdP in SAML.

Logout response sent

Number of user logout responses sent to the IdP in SAML.

Logout sanity fail

Count of logout request failed sanity checks such as issuer node value does not match configured IdP entity-id in SAML.

Logout signature verify fail

Count of logout request signature validation failures in SAML.

Memory allocation fail

Number of memory allocation failure while processing SAML request/responses.

Request hit cache

Count of SAML requests that hit the assertion cache.

Request sent to IdP

SAML requests miss assertion cache and sent to IdP.

Pool drain configured

Configuration state of active drain for the specified local address pool, yes or no.

Pool Usage

Percentage of allocated addresses in the specified address pool.

processed successfully

Number of dynamic requests processed successfully by the AAA framework.

errors during processing

Number of dynamic requests that resulted in processing errors by the AAA framework.

Link Name

Name of the secondary address-assignment pool to which the primary pool is linked.

silently dropped

Number of dynamic requests dropped by the AAA framework due to multiple back-to-back or duplicate requests.

RADIUS Server

IPv4 or IPv6 address of the RADIUS server to which the router is sending requests.

Profile

Name of the RADIUS profile associated with the RADIUS server. A RADIUS server can be associated with more than one RADIUS profile.

Configured

Configured maximum number of outstanding requests from the router to the RADIUS server for a specific profile. An outstanding request is a request to which the RADIUS server has not yet responded. The range of values is 0 through 2000 outstanding requests. The default value is 1000.

Current

Current number of outstanding requests from the router to the RADIUS server for a specific profile. An outstanding request is a request to which the RADIUS server has not yet responded.

Peak

Highest number of outstanding requests from the router to the RADIUS server for a specific profile at any point in time since the router was started or since the counter was last cleared.

Exceeded

Number of times that the router attempted to send requests to the RADIUS server in excess of the configured maximum value for a specific profile.

Username

Username for a subscriber with one or more active sessions for an access profile.

Access-profile

Name of the access profile where the username is active.

Blocked requests

Number of session requests that have been blocked for the username for an access profile. A request is blocked when it exceeds the configured session limit.

Session count

Number of active sessions for the username for an access profile.

Total usernames

Number of active usernames for all access profiles.

Total usernames exceeding session limit

Number of usernames that have attempted sessions greater than the limit configured for the username.

Total blocked requests

Number of session requests that have been blocked because the session limit is exceeded.