Accenture MDR Quick Start Guide for HA Proxy

This quick start guide will help Accenture MDR customers configure HA Proxy to send logs to the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring HA Proxy

To configure the HA Proxy to send the syslog events to the LCP, follow the below steps.

1. SSH to the Server CLI on which haproxy get deployed.

2. Configuration of rsyslog server to enable syslog reception over UDP.

Note: This is optional step and it does not get required if local syslog server has already been configured for log reception over UDP.

• To configure the rsyslog server to enable local syslog reception over UDP

• Stop rsyslog service and edit /etc/rsyslog.conf (default path for rsyslog configuration file) file to enable local syslog server reception over UDP using the below commands.
  

# sudo systemctl stop rsyslog.service
# sudo vi /etc/rsyslog.conf 

• Add the below lines in this configuration file. If you find them commented then uncomment them from the file. Save the file. 

$ModLoad imudp
$UDPServerRun 514

• Now start rsyslog service.

# sudo systemctl start rsyslog.service

 3. Steps to configure haprpxy with custom log-format and local syslog redirection.

• By default, haproxy configuration file- haproxy.cfg can be found at /etc/haproxy/ location if installed through standard installation. If you are using Docker, then this file is mounted as a volume into the container at the path /usr/local/etc/haproxy/haproxy.cfg.

• Edit the haproxy.cfg file to configure it with recommended Custom Log Format and redirect logs to local rsyslog server.

• Execute the following commands.

# sudo systemctl stop haproxy.service
# sudo vi /etc/haproxy/haproxy.cfg

• Under global config block section, append the following line.

log 127.0.0.1:514 local0

• Under defaults section, append the following config lines.

option httplog
log-format haproxy_accesslogs\ source_ip=%ci\ source_port=%cp\ time_stamp=[%t]\ destination_hostname=%s\ status_code=%ST\ bytes=%B\ query_info=%{+Q}r\ header_host=%[capture.req.hdr(0)]\ destination_ip=%si\ destination_port=%sp\ x_forwarded_for=%[capture.req.hdr(1)]\ referer=%[capture.req.hdr(2)]\ content_length=%[capture.req.hdr(3)]\ user_agent="%[capture.req.hdr(4)]"

Note: Reference Screenshot added below.

Note that the above configuration should be appended under the defaults section only to declare it as default logging configuration for all servers served by haproxy. Any other log configurations appended to the other sections such as frontend or listen may rule out the default logging configuration which we have followed here. 

• Although this configuration can also be appended to the other sections such as frontend or listen to get logs from that sections only.

• Under frontend block, append the following configuration lines.

capture request header Host len 40
capture request header X-Forwarded-For len 30
capture request header Referer len 64
capture request header Content-Length len 10
capture request header User-Agent len 80

Reference Screenshot added below.

• Now start the haproxy service. This will forward haproxy access logs to the local rsyslog server.

sudo systemctl start haproxy.service

4. Redirect haproxy logs to LCP.

• Create a new configuration file under /etc/rsyslog.d/. Ensure that it should start with prefix as 99.

For an example, create a new file named 99-lcp.conf under /etc/rsyslog.d path.  Execute the below Commands.

# sudo systemctl stop rsyslog.service
# sudo vi /etc/rsyslog.d/99-lcp.conf

• Paste the following lines and save the newly created file. This configuration will forward logs to LCP over TCP Protocol.

### Begin forwarding rule for Syslog Server
$WorkDirectory /var/spool/rsyslog # Where spool files will live
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files
$ActionQueueHighWaterMark 8000 #
$ActionQueueLowWaterMark 2000 #
$ActionQueueMaxDiskSpace 2g # use as much as possible
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown
$ActionQueueType LinkedList # Use asynchronous processing
$ActionResumeRetryCount -1 # Infinite retries if host is down

########## Filter haproxy logs and forward them to LCP over TCP ############
if $programname == 'haproxy' then @@<LCP-IP>:601;
& ~
############################################################################

• Start rsyslog service.

# sudo systemctl start rsyslog.service

LCP Configuration Parameters

Table 1-2: The HA Proxy event collector (Syslog -3961) properties to be configured by MDR are shown in the table.