• RSA Product Set: SecurID
• RSA Product/Service Type: Authentication Manager
• RSA Version/Condition: 8.5 and Below
• Component: RADIUS (Steel Belted RADIUS)

When troubleshooting RADIUS authentication failures or unexpected behavior in RSA Authentication Manager 8.5 and below, it may be necessary to enable RADIUS debug logging and verbose tracing to capture detailed diagnostic information.

RADIUS debug logs can help identify:

• Authentication request and response details
• RADIUS packet-level communication errors
• Misconfigurations in RADIUS server settings

CAUTION: Enabling RADIUS debug logging increases log verbosity and may impact server performance. Enable it only during active troubleshooting and disable it immediately when testing is complete.

1. Log in to the Operations Console using the Operations Console administrator username and password.

2. Navigate to Deployment Configuration > RADIUS Servers > Manage Existing.

3. Click the dropdown arrow next to the primary Authentication Manager server and select Manage Server Files.

4. Click the dropdown arrow next to the radiusd.conf file and select Edit.

5. Uncomment the following lines by removing the semicolon (;) or hash (#) from the beginning of each line

6. Set the debug_level values to 2, as shown:

   [Configuration]
   debug_level                   = 2

   NOTE: Accepted values are 0, 1, or 2 only.

7. Click Save & Restart RADIUS Server to apply the changes.
   NOTE: The server restart is required for the debug changes to take effect. 
8. Verify: Confirm that RADIUS debug logging is active by checking the log files located in /opt/rsa/am/radius. Log files are named in mmddyyyy.log format (date log files), where the date reflects the day they were written.
   
9. When RADIUS troubleshooting is complete, disable debug logging by repeating Steps 1–7, setting both LogLevel and TraceLevel back to 0, then clicking Save & Restart RADIUS Server. 

• Performance Impact: Debug logging at level 2 generates a high volume of log data and may affect RADIUS server performance. Always disable debug logging promptly after troubleshooting is complete.

• Log File Location: RADIUS log files for Authentication Manager 8.5 and below are stored in /opt/rsa/am/radius and are named in mmddyyyy.log format, where the date reflects the day the log was written.

• Version Scope: These steps apply to RSA Authentication Manager 8.5 and below only, which uses Steel Belted RADIUS. For Authentication Manager 8.6 and higher, which uses Free RADIUS, the debug configuration method differs. Refer to the applicable article for 8.6 and higher instructions Enable RADIUS Debug Logs For 8.6 And Later