Accenture MDR Quick Start Guide for HA Proxy

This quick start guide will help Accenture MDR customers configure HA Proxy to send logs to the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring HA Proxy

To configure the HA Proxy to send the syslog events to the LCP, follow the below steps.

1. SSH to the Server CLI on which haproxy get deployed.

2. Configuration of rsyslog server to enable syslog reception over UDP.

Note: This is optional step and it does not get required if local syslog server has already been configured for log reception over UDP.

• To configure the rsyslog server to enable local syslog reception over UDP

• Stop rsyslog service and edit /etc/rsyslog.conf (default path for rsyslog configuration file) file to enable local syslog server reception over UDP using the below commands.
  
  

• Add the below lines in this configuration file. If you find them commented then uncomment them from the file. Save the file. 

Open

• Now start rsyslog service.

 3. Steps to configure haprpxy with custom log-format and local syslog redirection.

• By default, haproxy configuration file- haproxy.cfg can be found at /etc/haproxy/ location if installed through standard installation. If you are using Docker, then this file is mounted as a volume into the container at the path /usr/local/etc/haproxy/haproxy.cfg.

• Edit the haproxy.cfg file to configure it with recommended Custom Log Format and redirect logs to local rsyslog server.

• Execute the following commands.

• Under global config block section, append the following line.

• Under defaults section, append the following config lines.

Note: Reference Screenshot added below.

Open

Note that the above configuration should be appended under the defaults section only to declare it as default logging configuration for all servers served by haproxy. Any other log configurations appended to the other sections such as frontend or listen may rule out the default logging configuration which we have followed here. 

• Although this configuration can also be appended to the other sections such as frontend or listen to get logs from that sections only.

• Under frontend block, append the following configuration lines.

Reference Screenshot added below.

• Now start the haproxy service. This will forward haproxy access logs to the local rsyslog server.

4. Redirect haproxy logs to LCP.

• Create a new configuration file under /etc/rsyslog.d/. Ensure that it should start with prefix as 99.

For an example, create a new file named 99-lcp.conf under /etc/rsyslog.d path.  Execute the below Commands.

• Paste the following lines and save the newly created file. This configuration will forward logs to LCP over TCP Protocol.

• Start rsyslog service.

LCP Configuration Parameters

Table 1-2: The HA Proxy event collector (Syslog -3961) properties to be configured by MDR are shown in the table.