Back to All Scenarios
PASSEDnetwork / radius_accounting_failure
RADIUS Accounting Failure — Billing Data Loss
The RADIUS accounting server becomes unresponsive, causing all network access devices to fail sending accounting records. ISP billing data is lost for 8 hours, and compliance logging for network access events stops.
Pattern
SNMP_TRAP_ERROR
Severity
CRITICAL
Confidence
85%
Remediation
Auto-Heal
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | SNMP_TRAP_ERROR | SNMP_TRAP_ERROR | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 8 linked | |
| Cascade Escalation | N/A | No | |
| Remediation | — | Auto-Heal — Corax resolves autonomously |
Scenario Conditions
FreeRADIUS accounting server crashed. 45 NAS devices sending accounting to failed server. No redundant RADIUS accounting server configured. 8 hours of billing records lost. ISP customer usage data missing for billing cycle.
Injected Error Messages (2)
RADIUS accounting server unresponsive — FreeRADIUS process crashed, all 45 NAS devices failing to send accounting records, snmp trap from radius01: service down, 8 hours of billing data lost, ISP customer usage records missing for current billing cycle
Network access devices reporting accounting failures — snmp trap received from 45 NAS devices: RADIUS accounting destination unreachable, accounting requests being dropped, compliance logging gap, snmp trap storm from NAS fleet indicating radius service failure
Neural Engine Root Cause Analysis
The FreeRADIUS accounting service process has crashed on radius01, causing complete failure of RADIUS accounting functionality. This is evidenced by the SNMP trap indicating service down status and the inability of all 45 NAS devices to send accounting records to port 1813. The crash has resulted in significant operational impact with 8 hours of billing data loss and missing ISP customer usage records for the current billing cycle.
Remediation Plan
1. Restart the FreeRADIUS service on radius01 server 2. Verify service is listening on port 1813 3. Test connectivity from a sample NAS device 4. Check FreeRADIUS logs for crash cause and errors 5. Monitor accounting record reception for 10-15 minutes 6. If restart fails, check system resources (disk space, memory) and investigate core dumps 7. Implement log rotation or address any underlying resource constraints found
Tested: 2026-03-30Monitors: 2 | Incidents: 2Test ID: cmnck2640068pobqewngprmcg