Accenture MDR Quick Start Guide for HA Proxy

This quick start guide will help Accenture MDR customers configure HA Proxy to send logs to the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring HA Proxy

By using this method, one can customize Haproxy log format and forward syslog to LCP over TCP only.

Platforms -
CentOS/RHEL 7
Debian release 10 (buster/sid) 

Find the steps -

• Kindly take SSH access to the Server CLI on which haproxy get deployed.

• Configuration of rsyslog server to enable syslog reception over UDP. This is optional step and it does not get required if local syslog server has already been configured for log reception over udp.

Here we need to configure the rsyslog server to enable local syslog reception over UDP first if it does not get found enabled.
Stop rsyslog service and edit /etc/rsyslog.conf (default path for rsyslog configuration file) file to enable local syslog server reception over UDP.
Find commands.

# sudo systemctl stop rsyslog.service
# sudo vi /etc/rsyslog.conf 

Add the below lines in this configuration file. If you find them commented then uncomment them from the file. Save the file. 

$ModLoad imudp
$UDPServerRun 514

Find the snapshot for your reference.

Now start rsyslog service.

# sudo systemctl start rsyslog.service

• Steps to configure haprpxy with custom log-format and local syslog redirection.

By default, haproxy configuration file haproxy.cfg can be found at /etc/haproxy/haproxy.cfg if installed through standard installation. If you are using Docker, then this file is mounted as a volume into the container at the path /usr/local/etc/haproxy/haproxy.cfg.

Here we need to modify haproxy.cfg file to configure it with recommended Custom Log Format and redirect logs to local rsyslog server.

Execute the following commands.

# sudo systemctl stop haproxy.service
# sudo vi /etc/haproxy/haproxy.cfg

Under global config block section, kindly append the following line.

log 127.0.0.1:514 local0

Under defaults section, kindly append the following config lines.

option httplog
log-format haproxy_accesslogs\ source_ip=%ci\ source_port=%cp\ time_stamp=[%t]\ destination_hostname=%s\ status_code=%ST\ bytes=%B\ query_info=%{+Q}r\ header_host=%[capture.req.hdr(0)]\ destination_ip=%si\ destination_port=%sp\ x_forwarded_for=%[capture.req.hdr(1)]\ referer=%[capture.req.hdr(2)]\ content_length=%[capture.req.hdr(3)]\ user_agent="%[capture.req.hdr(4)]"

Find Screenshot for your reference.

Note that the above configuration should be appended under the defaults section only to declare it as default logging configuration for all servers served by haproxy. Any other log configurations appended to the other sections such as frontend or listen may rule out the default logging configuration which we have followed here. 

Although this configuration can also be appended to the other sections such as frontend or listen to get logs from that sections only; which further depends on customer’s requirements.

Under frontend block, append the following configuration lines.

capture request header Host len 40
capture request header X-Forwarded-For len 30
capture request header Referer len 64
capture request header Content-Length len 10
capture request header User-Agent len 80

Find snapshot.

Now start the haproxy service. This will forward haproxy access logs to the local rsyslog server.

sudo systemctl start haproxy.service

• Redirect haproxy logs to LCP.

Now create a new configuration file under /etc/rsyslog.d/. Ensure that it should start with prefix as 99. For an example, create a new file named 99-lcp.conf under /etc/rsyslog.d path.  Find Commands.

# sudo systemctl stop rsyslog.service
# sudo vi /etc/rsyslog.d/99-lcp.conf

Paste the following lines and save the file. This configuration will forward logs to LCP over TCP Protocol.

### Begin forwarding rule for Syslog Server
$WorkDirectory /var/spool/rsyslog # Where spool files will live
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files
$ActionQueueHighWaterMark 8000 #
$ActionQueueLowWaterMark 2000 #
$ActionQueueMaxDiskSpace 2g # use as much as possible
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown
$ActionQueueType LinkedList # Use asynchronous processing
$ActionResumeRetryCount -1 # Infinite retries if host is down

########## Filter haproxy logs and forward them to LCP over TCP ############
if $programname == 'haproxy' then @@<LCP-IP>:601;
& ~
############################################################################

Start rsyslog service.

# sudo systemctl start rsyslog.service

LCP Configuration Parameters

Table 1-2: The HA Proxy event collector (Syslog -3961) properties to be configured by MDR are shown in the table.