Page Comparison

...

Configuring HA Proxy

...

Note: This is optional step and it does not get required if local syslog server has already been configured for log reception over UDP. 3.

• To configure the rsyslog server to enable local syslog reception over UDP

...

• Stoprsyslog service and edit /etc/rsyslog.conf (default path for rsyslog configuration file) file to enable local syslog server reception over UDP using the below commands.
  

# sudo systemctl stop rsyslog.service
# sudo vi /etc/rsyslog.conf 

...

• Add the below lines in this configuration file. If you find them commented then uncomment them from the file. Save the file. 

$ModLoad imudp
$UDPServerRun 514

...

...

• Now start rsyslog service.

Code Block
# sudo systemctl start rsyslog.service

 7 3. Steps to configure haprpxy with custom log-format and local syslog redirection. 8.

• By default, haproxy configuration file- haproxy.cfg can be found at /etc/haproxy/ location if installed through standard installation. If you are using Docker, then this file is mounted as a volume into the container at the path /usr/local/etc/haproxy/haproxy.cfg.

...

• Edit the haproxy.cfg file to configure it with recommended Custom Log Format and redirect logs to local rsyslog server.

• Execute the following commands.

Code Block
# sudo systemctl stop haproxy.service # sudo vi /etc/haproxy/haproxy.cfg

...

• Under global config block section, append the following line.

Code Block
log 127.0.0.1:514 local0

...

• Under defaults section, append the following config lines.

Code Block
option httplog log-format haproxy_accesslogs\ source_ip=%ci\ source_port=%cp\ time_stamp=[%t]\ destination_hostname=%s\ status_code=%ST\ bytes=%B\ query_info=%{+Q}r\ header_host=%[capture.req.hdr(0)]\ destination_ip=%si\ destination_port=%sp\ x_forwarded_for=%[capture.req.hdr(1)]\ referer=%[capture.req.hdr(2)]\ content_length=%[capture.req.hdr(3)]\ user_agent="%[capture.req.hdr(4)]"

...

Note that the above configuration should be appended under the defaultssection only to declare it as default logging configuration for all servers served by haproxy. Any other log configurations appended to the other sections such as frontendor listenmay rule out the default logging configuration which we have followed here.  12.

• Although this configuration can also be appended to the other sections such as frontend or listen to get logs from that sections only.

...

• Under frontend block, append the following configuration lines.

Code Block
capture request header Host len 40 capture request header X-Forwarded-For len 30 capture request header Referer len 64 capture request header Content-Length len 10 capture request header User-Agent len 80

Reference Screenshot added below.

...

...

• Now start the haproxy service. This will forward haproxy access logs to the local rsyslog server.

Code Block
sudo systemctl start haproxy.service

15 4. Redirect haproxy logs to LCP. 16.

• Create a new configuration file under /etc/rsyslog.d/. Ensure that it should start with prefix as 99.

For an example, create a new file named 99-lcp.conf under /etc/rsyslog.d path.  Execute the below Commands.

Code Block
# sudo systemctl stop rsyslog.service # sudo vi /etc/rsyslog.d/99-lcp.conf

...

• Paste the following lines and save the newly created file. This configuration will forward logs to LCP over TCP Protocol.

Code Block

### Begin forwarding rule for Syslog Server $WorkDirectory /var/spool/rsyslog # Where spool files will live $ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files $ActionQueueHighWaterMark 8000 # $ActionQueueLowWaterMark 2000 # $ActionQueueMaxDiskSpace 2g # use as much as possible $ActionQueueSaveOnShutdown on # Save messages to disk on shutdown $ActionQueueType LinkedList # Use asynchronous processing $ActionResumeRetryCount -1 # Infinite retries if host is down ########## Filter haproxy logs and forward them to LCP over TCP ############ if $programname == 'haproxy' then @@<LCP-IP>:601; & ~ ############################################################################

...

• Start rsyslog service.

Code Block
# sudo systemctl start rsyslog.service

...

Property	Default Value	Description
Protocol	TCP	The default protocol for syslog. Device only support logs to be shared over TCP.
IP Address	HA Proxy IP Address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Signatures	haproxy[,haproxy_accesslogs	MDR recommended signatures processed by the HA Proxy event collector.
Port Number	6514604	The default port number for syslog. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.

...