Sending HAProxy logs to Graylog

May 22, 2019

•

3 min read

I just finished the setup of a brand new Graylog 3 server and wanted to share my configuration for sending HAProxy logs. I’m not digging into the server setup. It’s super simple; you can find out docker-compose configuration on the official docs. https://docs.graylog.org/en/3.0/pages/installation/docker.html

Don’t be stingy for the ram; give the proper space for god’s sake. (depends on your data for sure)

Here is the configuration that I use:

	# Create an additional socket in haproxy's chroot in order to allow logging via
	# /dev/log to chroot'ed HAProxy processes
	$template GRAYLOGRFC5424,"<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
	$AddUnixListenSocket /var/lib/haproxy/dev/log

	# Send HAProxy messages to a dedicated logfile
	if $programname startswith 'haproxy' then /var/log/haproxy.log
	if $syslogtag contains 'haproxy' then @192.168.1.10:1514;GRAYLOGRFC5424
	&~

view raw 49-haproxy.conf hosted with ❤ by GitHub

	.
	.
	.
	defaults
	mode http
	log global
	log-format {"haproxy_clientIP":"%ci","haproxy_clientPort":"%cp","haproxy_dateTime":"%t","haproxy_frontendNameTransport":"%ft","haproxy_backend":"%b","haproxy_serverName":"%s","haproxy_Tw":"%Tw","haproxy_Tc":"%Tc","haproxy_Tt":"%Tt","haproxy_bytesRead":"%B","haproxy_terminationState":"%ts","haproxy_actconn":%ac,"haproxy_FrontendCurrentConn":%fc,"haproxy_backendCurrentConn":%bc,"haproxy_serverConcurrentConn":%sc,"haproxy_retries":%rc,"haproxy_srvQueue":%sq,"haproxy_backendQueue":%bq,"haproxy_backendSourceIP":"%bi","haproxy_backendSourcePort":"%bp"}
	option httplog
	.
	.
	.
	.
	.
	.

view raw haproxy.cfg hosted with ❤ by GitHub

add “log-format” to your haproxy configuration and then reload the service.
change IP address and make sure the port mapped properly on the docker configuration.
restart rsyslog service

Go On Popcorn GIF - Find & Share on GIPHY — now you can watch the stream 🙂

remember: “iptables -L” is your friend 😉

4 responses

Felipe

Sep 2, 2019

how about graylog configuration part?
should it be a GELF ? RAW syslog ? and how is the parse done?
pelase share
thx

Loading…

Reply
1. mustafauysal
  
  Sep 8, 2019
  
  Syslog UDP. You can use extractors for parsing.
  
  Loading…
  
  Reply
  1. Chandra
    
    Aug 25, 2022
    
    Can you also explain process for haproxy enterprise edition
    
    Loading…
    
    Reply
    1. mustafauysal
      
      Aug 26, 2022
      
      I have no experience with the enterprise edition. However, I don’t think it will be any different.
      
      Loading…
      
      Reply

Sending HAProxy logs to Graylog

4 responses

Leave a Reply Cancel reply