Audit logs for RADIUS aren’t optional. They’re the only way to see, with certainty, who connected, when, from where, and with what result. Without them, your network is a dark room — users come and go, but you can’t tell which door they used, or if they were even supposed to be there.
RADIUS audit logs turn that darkness into daylight. A well-structured RADIUS audit log records authentication requests, accounting events, access acceptances, and rejections. It tells the full story: username, timestamp, NAS-IP, calling station ID, response code, and session length. This isn’t clutter. It’s evidence. It’s the data that lets you enforce policy, detect abuse, and meet compliance standards without guessing.
To do it right, you need more than a scattered list of events. You need consistent formatting, secure storage, and clear retention rules. Logs should be written in a structured format like JSON or CSV for easy parsing. Time should always be stored in UTC to avoid confusion when correlating events. Sensitive elements — like passwords — should never be logged. Access to the logs themselves should be locked down with at least the same care as production credentials.