On 11/18/2023 08:07, Christoph Kukulies wrote:
For haproxy I don't have a log-format string.
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
compression algo gzip
compression type text/html text/css text/plain text/vcard
text/vnd.rim.location.xloc text/vtt text/x-component
text/x-cross-domain-policy application/atom+xml application/javascript
application/x-javascript application/json application/ld+json
application/manifest+json application/rss+xml application/vnd.geo+json
application/vnd.ms-fontobject application/x-font-ttf
application/x-web-app-manifest+json application/xhtml+xml
application/xml font/opentype image/bmp image/svg+xml image/x-icon
text/cache-manifest
balance roundrobin
option dontlog-normal
option dontlognull
option httpclose
option forwardfor
If that's the extent of the logging configuration, then I wonder whether
you've actually got logging set up. Or if you do, maybe it's not going
where you think it's going.
These are the lines logged by haproxy when I tell my browser to go to my
blog:
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:64098
[18/Nov/2023:15:47:55.449] web~ be_smeagol_81/smeagol 0/0/2/227/229 200
18218 - - --NI 1/1/0/0/0 0/0 {purg.atory.org} "GET
https://purg.atory.org/ HTTP/2.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.708] web~ be_smeagol_81/smeagol 0/0/0/3/3 200 2625
- - --VN 1/1/4/4/0 0/0 {purg.atory.org} "GET
/wp-includes/blocks/navigation/style.min.css?ver=6.4.1 HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.709] web~ be_smeagol_81/smeagol 0/0/0/5/5 200 2484
- - --VN 1/1/3/3/0 0/0 {purg.atory.org} "GET
/wp-content/themes/twentytwentytwo/style.css?ver=1.6 HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.709] web~ be_smeagol_81/smeagol 0/0/0/13/13 200
1474 - - --VN 1/1/3/3/0 0/0 {purg.atory.org} "GET
/wp-includes/blocks/navigation/view.min.js?ver=e3d6f3216904b5b42831
HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.709] web~ be_smeagol_81/smeagol 0/0/0/17/17 200
1057 - - --VN 1/1/2/2/0 0/0 {purg.atory.org} "GET
/wp-includes/js/wp-embed.min.js?ver=6.4.1 HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.709] web~ be_smeagol_81/smeagol 0/0/0/38/38 200
12360 - - --VN 1/1/2/2/0 0/0 {purg.atory.org} "GET
/wp-includes/js/dist/interactivity.min.js?ver=6.4.1 HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.714] web~ be_smeagol_81/smeagol 0/0/0/33/34 200
103948 - - --VN 1/1/1/1/0 0/0 {purg.atory.org} "GET
/wp-content/themes/twentytwentytwo/assets/images/flight-path-on-transparent-d.png
HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.746] web~ be_smeagol_81/smeagol 0/0/0/9/30 200
428789 - - --VN 1/1/0/0/0 0/0 {purg.atory.org} "GET
/wp-content/themes/twentytwentytwo/assets/fonts/source-serif-pro/SourceSerif4Variable-Roman.ttf.woff2
HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.779] web~ be_smeagol_81/smeagol 0/0/0/-1/166 404
1634 - - LHVN 1/1/1/1/0 0/0 {purg.atory.org} "GET
/wp-content/uploads/2022/09/sylized-e.jpeg HTTP/3.0"
Nov 18 15:47:55 - haproxy[5915] 192.168.217.1:54363
[18/Nov/2023:15:47:55.864] web~ be_smeagol_81/smeagol 0/0/0/-1/84 400
1232 - - CDVN 1/1/0/0/0 0/0 {purg.atory.org} "GET
/wp-content/uploads/2022/09/sylized-e.jpeg HTTP/3.0"
That logging doesn't include port numbers, but that information is
obtainable by reference. You'll see that it says "web~
be_smeagol_81/smeagol" ... which means that the frontend in use is named
"web" ... the ~ means that it is using TLS ... the backend is named
"be_smeagol_81" and the server within the backend is named "smeagol".
It just so happens that this backend goes to port 81, and I did put that
number in the backend name, but not everyone does.
I send my haproxy logging to syslog. The system runs rsyslog, which is
responsible for getting them into actual logs on disk.
global
log 127.0.0.1 len 65535 format rfc5424 local0
log 127.0.0.1 len 65535 format rfc5424 local1 notice
Thanks,
Shawn
