UDR (Usage Detail Record) — aggregated records of how much traffic, and of what kind, a subscriber transferred over a time interval, enriched with data from the subscriber session: login, IP address, network access server (NAS), and for mobile networks — IMSI, IMEI, radio access type, location, etc.

UDRs make it possible to link network activity to a specific subscriber and pass this data to external systems. Depending on the source of network data, two types of UDRs are generated:

• Session UDRs (SSL UDR) — based on Fullflow data;
• HTTP request UDRs (HTTP UDR) — based on Clickstream data on HTTP and HTTPS requests.

UDR generation is an optional feature and is disabled by default.

Data received from AAA receivers is written to the raw aaaflow table, which is created automatically when AAA receivers are configured. While data from the receivers is being inserted into aaaflow, the following tables are also populated:

• aaa_ip_login_bind — used as a dictionary for linking and replacing the Login field in the fullflow and clickstream tables.
• aaa_acc_state — subscriber session state. Subscriber data is taken from it into UDRs.
• aaa_udr_fullflow — session UDR table. Required for generating and exporting SSL UDRs (and other UDR types, depending on the filters applied).
• aaa_udr_clickstream — HTTP request UDR table. Required for generating and exporting HTTP UDRs, including those for HTTPS requests.

How records are generated:

• UDRs are populated automatically when Fullflow and Clickstream data is loaded; there is no separate calculation process.
• Subscriber data is taken from the aaa_acc_state table by the "login, subscriber IP address" pair.
• The time of each record is rounded to the UDR interval — 15 minutes by default.
• UDRs are stored in hourly partitions. To read data from all cluster nodes, use the aaa_udr_fullflow_dist and aaa_udr_clickstream_dist tables.
• Population can be limited by a selection condition, for example, only certain protocols or subscribers.

Accumulated UDRs are exported to files one interval at a time, compressed (gzip), and placed in the /var/qoestor/backend/dump/udr_fullflow/success/ and /var/qoestor/backend/dump/udr_clickstream/success/ directories. The export is started by the administrator manually or on a schedule.

If the UDR_SCP parameter is set, the files are also sent via SCP to the specified directory on a remote server. Files that could not be sent are moved to the error/ subdirectory.

UDR parameters are set in Administrator → QoE Stor configuration → AAA log settings or in the /var/qoestor/backend/.env file. When the file is edited manually, changes are applied differently:

• Population: FILL_*, UDR_FULLFLOW_TIME_INTERVAL, UDR_CLICKSTREAM_TIME_INTERVAL — run fastor-reload-options
• Schema: UDR_FULLFLOW_CLICKSTREAM_JOIN, UDR_FULLFLOW_FILTER, UDR_CLICKSTREAM_FILTER, FILL_UDR_FULLFLOW_DIC_LIFETIME, FILL_UDR_FULLFLOW_DIC_LIMIT — run fastor-db-aaa-scheme
• Export: all other UDR_* parameters — nothing; the parameters are read on every export run

For the full list of parameters, see Parameter description.

UDR generation and export require a dedicated database schema. It is installed with the command:

fastor-db-aaa-scheme

Run the command again after every change to the schema parameters: the volume retrieval mode, selection conditions, or dictionary parameters.

Add AAA receivers: in Administrator → QoE Stor configuration, create a receiver of the "AAA flow" type. Learn more about creating receivers

In Administrator → QoE Stor configuration → AAA log settings, configure the AAA logs.

Enable the FILL_IP_LOGIN_BINDING_FROM_AAA and AAA_REPLACE_LOGIN_IP_LOGIN_BIND parameters only if IP-to-Login binding is required on the QoE Stor side.

The following parameters must be enabled for UDR generation:

• FILL_ACC_STATE_FROM_AAA — always;
• FILL_UDR_FULLFLOW — for session UDRs, and also for HTTP request UDRs with traffic volumes (modes 1 and 2 of the UDR_FULLFLOW_CLICKSTREAM_JOIN parameter);
• FILL_UDR_CLICKSTREAM — for HTTP request UDRs. If only session UDRs are needed, do not enable this parameter.

Traffic volume, duration, and protocol for HTTP request UDRs are taken from session UDRs. The method is set by the UDR_FULLFLOW_CLICKSTREAM_JOIN parameter:

• 0 (default) — volume, duration, and protocol are not filled in; the time is taken from the request time. Use it when only the requests themselves are needed
• 1 — data is taken by a direct join with session UDRs. Use it when volumes are needed and session UDRs are enabled
• 2 — data is taken from a dictionary that holds session UDRs for the current and previous intervals. Use it when volumes are needed; the dictionary size and refresh period must be set

For modes 1 and 2, FILL_UDR_FULLFLOW must be enabled. For mode 2, also enable FILL_UDR_FULLFLOW_DIC and set FILL_UDR_FULLFLOW_DIC_LIMIT and FILL_UDR_FULLFLOW_DIC_LIFETIME: with the default values (0), the dictionary stays empty.

Mode 2 configuration example:

UDR_FULLFLOW_CLICKSTREAM_JOIN=2
FILL_UDR_FULLFLOW_DIC=1
FILL_UDR_FULLFLOW_DIC_LIFETIME=60
FILL_UDR_FULLFLOW_DIC_LIMIT=5000000

The dictionary size and refresh period values in the example are for illustration only — choose them based on traffic volume and node memory.

After changing the mode, run fastor-db-aaa-scheme (see Database schema).

The instructions below apply only if UDR export is required

In Administrator → QoE Stor configuration → AAA log settings, configure the connection between QoE Stor and the UDR storage server using an SSH key.

1. Specify the SCP server in the UDR_SCP parameter
2. Specify the port in the UDR_SCP_PORT parameter
3. Specify the directory on the server in the UDR_SCP_DIR parameter
4. Set the export format in the UDR_FULLFLOW_FORMAT and UDR_CLICKSTREAM_FORMAT parameters

Files are sent with the scp command without a password prompt, so key-based SSH login to the remote server must be configured for the user who runs the export. To check access:

ssh -p 22 udr@192.0.2.20 "ls /data/udr/"

If sending files to a remote server is not needed, do not set UDR_SCP — the files will remain in the success/ subdirectory on the QoE Stor server.

Installing the package does not create an export schedule. Configure the UDR export schedule in the root user's crontab on the QoE Stor server.

1. Run crontab -e and add two entries:

   */15 * * * * sh /var/qoestor/backend/app_bash/aaa_udr/make_udr_fullflow.sh > /dev/null 2>&1
   */15 * * * * sh /var/qoestor/backend/app_bash/aaa_udr/make_udr_clickstream.sh > /dev/null 2>&1

2. In Administrator → QoE Stor configuration → AAA log settings, configure the data export:
   1. Set the aggregation interval: the period to which the time of UDR records is rounded. Default: 15 minutes. See UDR_FULLFLOW_TIME_INTERVAL and UDR_CLICKSTREAM_TIME_INTERVAL. It is recommended to set both intervals to the same value.
   2. Set the time range: defines the start and end of the export period. See UDR_FULLFLOW_PERIOD_FROM → UDR_FULLFLOW_PERIOD_TO and UDR_CLICKSTREAM_PERIOD_FROM → UDR_CLICKSTREAM_PERIOD_TO

The crontab run period must match the UDR interval: with the default settings, each run exports one previous completed interval. If the interval is changed, change the crontab period as well.

If a UDR file was not created, was generated with an error, or in other similar situations, you can create a UDR file manually.

Files are generated from the aaa_udr_fullflow and aaa_udr_clickstream tables, so UDRs can only be generated for a period that is still stored in these tables (see Storage).

The UDR creation script can be run manually. Without parameters, it exports the previous completed interval; a custom period is set with the --from and --to keys:

• For Clickstream UDRs:

  sh /var/qoestor/backend/app_bash/aaa_udr/make_udr_clickstream.sh --from '2025-11-19 14:30:00' --to '2025-11-19 14:45:00'

• For Fullflow UDRs:

  sh /var/qoestor/backend/app_bash/aaa_udr/make_udr_fullflow.sh --from '2025-11-19 14:45:00' --to '2025-11-19 15:00:00'

The script does not print anything to the console; the result is written to the log (see Checking and viewing UDRs).

UDRs can only be generated in blocks equal to the UDR interval (15 minutes by default), for example:

• 10:00 – 10:15;
• 10:15 – 10:30;
• 10:30 – 10:45, etc.

The file will be placed in the same directory as the automatically generated UDRs:

• /var/qoestor/backend/dump/udr_clickstream/success/ — for Clickstream UDRs;
• /var/qoestor/backend/dump/udr_fullflow/success/ — for Fullflow UDRs.

The file is named after the interval start time in the YYYYMMDDHHMMSS format: SSL_<start>.dump.gz for Fullflow UDRs and HTTP_<start>.dump.gz for Clickstream UDRs. For example, for the period from 19.11.2025 14:45:00 to 19.11.2025 15:00:00, the Fullflow UDR file will be named SSL_20251119144500.dump.gz.

Storage can be limited with two parameters in Administrator → GUI configuration → QoE Stor: DB lifetime settings:

• QOESTOR_AAA_MAIN_LOG_PARTITIONS_LIFE_TIME_HOUR — retention time of the raw AAA log, in hours. Default: 2 hours.
• QOESTOR_AAA_UDR_LOG_PARTITIONS_LIFE_TIME_HOUR — retention time of aggregated UDR logs, in hours. Default: 2 hours.

Files in the success/ and error/ directories are not deleted automatically — monitor free disk space and set up their cleanup.

After enabling population, wait for the next data load (every 10 minutes by default) and run:

clickhouse-client --query "select udr_time, count() from qoestor.aaa_udr_fullflow where udr_time > now() - 3600 group by udr_time order by udr_time"
clickhouse-client --query "select udr_time, count() from qoestor.aaa_udr_clickstream where udr_time > now() - 3600 group by udr_time order by udr_time"

Rows for the latest intervals should appear. If there are none, check that AAA events and Fullflow and Clickstream data are being received.

tail -n 20 /var/qoestor/backend/logs/udr_fullflow.log
tail -n 20 /var/qoestor/backend/logs/udr_clickstream.log

A successful export is indicated by the lines Dump made …, Dump gzip made … and Dump was sended to … (or Dump … to …/success/ if UDR_SCP is not set). Lines with the ERROR level indicate a query or compression failure.

The error/ directory should be empty: it receives files that could not be sent to the remote server. Once the cause is fixed, they can be sent manually.

To view UDR files, go to the directory with the required UDR type on the QoE Stor server:

cd /var/qoestor/backend/dump/udr_clickstream/success/

Use zcat, zgrep, zless and other utilities for compressed files:

zcat HTTP_20260205150000.dump.gz

where HTTP_20260205150000.dump.gz is the UDR file name, with the interval start time in the YYYYMMDDHHMMSS format.

Command output:

In this example, the | character is used as the delimiter. The delimiter can be changed in the settings — see the Parameter description table for details on this parameter

[vasexpertsmnt@qoe02 success]$ zgrep 11223344550 HTTP_2026020515*
HTTP_20260205150000.dump.gz:|dpi02|11223344550||speedtest.tele2.net/10MB.zip|11198323|300628|117|GET|482129275|10.20.30.40|PGW-01-431|random-apn|192.168.111.123|6||10.0.2.112|speedtest.tele2.net|123456789012345|200|20260205151435|200|200|Mozilla/5.0 (iPhone CPU iPhone OS 26_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1|9876543212345678|11111|http://speedtest.tele2.net/|application/zip|||

One record is generated per "subscriber, subscriber IP address, server IP address, host" combination per UDR interval.

Traffic volumes and duration are filled in only if the UDR_FULLFLOW_CLICKSTREAM_JOIN parameter is 1 or 2 (see Traffic volumes in HTTP request UDRs).

With UDR_CLICKSTREAM_TPL=1, HTTP request UDRs are generated with a compact set of fields:

• start and end time;
• MSISDN, IMSI, IMEI;
• protocol;
• host IP address and port;
• network protocol;
• radio access type (RAT Type);
• traffic volumes;
• APN;
• duration;
• subscriber IP address and port;
• SGSN IP;
• subscriber location (ULI);
• Request Domain;
• Dest.

By default, UDR files are generated using the templates above. Additional fields can be added on request to technical support.