Radius Server Logs
You collect radius server logs by routing login events to a central log store. These records show who tried to log in, when they tried, and the result. Most teams set up a network server to check user identities against a directory. They then forward those login records to a shared log platform for security checks. Still, teams often grant broad network roles to avoid blocking daily engineering work. Once a user passes that login check, the network log stops tracking their actions. How radius
Kubernetes API Server Access + Kubernetes Audit Logs: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You collect radius server logs by routing login events to a central log store. These records show who tried to log in, when they tried, and the result. Most teams set up a network server to check user identities against a directory. They then forward those login records to a shared log platform for security checks. Still, teams often grant broad network roles to avoid blocking daily engineering work. Once a user passes that login check, the network log stops tracking their actions.
How radius server logs work in your network
A network device asks the central server to check a user before granting entry. When an engineer logs into a VPN or switch, the device sends a request. The server checks the user name and secret against an identity directory. It then sends back an accept or reject message to the network device. At that moment, the service writes a record to the radius server logs.
Accounting logs add basic session details to these initial login records. The network device sends a start message when the user session begins. It sends a stop message when the user closes the session. These messages record the session length and the amount of data sent. Admins read these files to spot failed logins or strange login times. Teams also ship these records to a central log tool for long-term storage.
What network login logs solve and what they miss
These records prove that a user passed a network check at a specific time. They help security teams spot brute-force attacks against VPN endpoints or Wi-Fi networks. If a bad actor guesses passwords, the reject count spikes right away. Admins can also see which IP address a user received for that session. This setup works well for basic network entry checks.
Still, a login record only shows who opened the front door. It does not show what commands or queries the user ran inside. Once on the network, an engineer might open a production database or Kubernetes cluster. The network log sees packets moving, but it cannot read the SQL queries. It cannot stop an engineer from dropping a table or pulling customer card numbers. Shared database accounts make this visibility gap even worse for audit teams. Two engineers might pass the network check and then use the same database role. The login log shows both engineers on the network at that exact hour. Yet the database log only shows the shared role name. You still cannot link a specific SQL query to a single person.
Kubernetes API Server Access + Kubernetes Audit Logs: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Moving from network logs to command-level audits
Modern audit rules require more than a simple record of network entry. Security teams need to see every query and command tied to a real user. They also need a way to inspect results before sensitive data reaches a laptop. For example, masking can rewrite emails, phone numbers, or national IDs in query results. Network login records cannot inspect data streams or rewrite fields in flight. Closing this gap requires moving controls closer to the actual databases and servers.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What information do radius server logs contain?
They record the user name, login time, device address, and accept or reject status. Accounting records also track session time and total bytes sent over the network.
Why are network login logs not enough for database audits?
They only log the initial network entry and session time. They do not record the SQL queries, shell commands, or data returned during the session.
How long should teams keep network login records?
Retention rules depend on your internal security policy and industry audit standards. Many teams ship these records to cold storage for several months or a full year.