Description

Users may find that the "Tacplus accounting process terminated (signal 13)" syslog message is generated on the router after upgrade. This article clarifies that the message reports an event and not an error so it can be ignored safely.

Note: This syslog message was introduced from Junos OS 18.2R1. See AUDITD_TACPLUS_ACCOUNTING_PROCESS_TERMINATED .

Symptoms

When "Tacplus accounting process" is terminated, the following event is reported: 

<Host> auditd[<pid>]: %DAEMON-4-AUDITD_TACPLUS_ACCOUNTING_PROCESS_TERMINATED: Tacplus accounting process terminated (signal 13)

Solution

By default, a device running Junos OS creates a new TCP connection for every accounting packet that it sends to the TACPLUS server.

If single-connection is configured, the same TCP connection is used for multiple packets. Note that single-connection must be supported by both the device running Junos OS and the TACPLUS server for this to work.

If single-connection is not supported by the TACPLUS server, it must gracefully end the connection. In this case, the device running Junos OS will create a new connection every time and there will be no issue.

If, on the other hand, the TACPLUS server ends the connection abruptly, the device running Junos OS will try to send packets using the same connection. The device running Junos OS will try to write on the socket but there is no reader on the TACPLUS server end to validate the connection because the connection is already closed. This results in a SIGPIPE signal being sent to the auditd process on the device. A SIGPIPE signal is sent to a process if it tries to write to a socket that has been shut down for writing or is not connected. The signal number for SIGPIPE is 13.

Then the following syslog message is reported on the device running Junos OS: 

<Host> auditd[<pid>]: %DAEMON-4-AUDITD_TACPLUS_ACCOUNTING_PROCESS_TERMINATED: Tacplus accounting process terminated (signal 13)

When single-connection is configured at both ends (device running Junos OS and the TACPLUS server side), all nodes see the log message indicating the TACPLUS auditd process termination. When single-connection is configured, the same connection is used for multiple packet exchanges and the connection is not closed after every request/response.

When the connection is idle for some time, the TACPLUS server sends RST,ACK, which results in the connection getting closed between the device running Junos OS and the TACPLUS server.

After the connection is closed, when the device running Junos OS tries to send an accounting request to the TACPLUS server, the process receives a SIGPIPE signal because the connection no longer exists and the TACPLUS auditd process is getting terminated.

This is indicated by the log message that we are seeing in the syslog. 

set system tacplus-server 172.16.1.1 port 49
set system tacplus-server 172.16.1.1 timeout 45
set system tacplus-server 172.16.1.1 single-connection
set system tacplus-server 172.16.1.1 source-address 192.168.1.1

There are two things that you could do:

  • If you enable single-connection on both sides and the session is idle for some time, it is expected behavior when the TACPLUS server sends RST, ACK. (This message reports an event, not an error.)

  • If you enable single-connection only on one side, for example from the Junos side, and disable it from the TACPLUS server side, no syslog message will be reported.