Trying to get HaProxy to log specific HTTP headers to custom file

0
votes

I'm using HaProxy as a reverse proxy and load balancer for three servers. Each of these servers uses Basic Authentication to control access to them and HaProxy shares the load across them via a round-robin method.

I'd like to log the IP address, user agent, request URL and Basic Authentication username for each request that HaProxy handles and to log this to a custom file so that another script can check periodically to ensure that credentials are not be shared by my users.

It looks like this possible to do but I cannot work out how to do it.

Here's what I've added to my haproxy.cfg file in my frontend section:

# Log name of server
capture request header Host len 500

# Capture request user agent
capture request header User-Agent len 64

# Capture authorization details
capture request header Authorization len 64

log-format "%ci:%cp [%t] %H %HP %hr %hrl"

When I include this in my haproxy.cfg file I and restart the service HaProxy fails to start. Looking in 'systemctl status haproxy.service' results in:

haproxy.service - HAProxy Load Balancer
   Loaded: loaded (/lib/systemd/system/haproxy.service; enabled)
   Active: failed (Result: start-limit) since Mon 2018-06-18 13:09:04 BST; 18s ago
   Docs: man:haproxy(1)
       file:/usr/share/doc/haproxy/configuration.txt.gz
   Process: 25529 ExecReload=/bin/kill -USR2 $MAINPID (code=exited, status=0/SUCCESS)
   Process: 25527 ExecReload=/usr/sbin/haproxy -c -f ${CONFIG} (code=exited, status=0/SUCCESS)
   Process: 9883 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f ${CONFIG} -p /run/haproxy.pid $EXTRAOPTS (code=exited, status=0/SUCCESS)
   Process: 10644 ExecStartPre=/usr/sbin/haproxy -f ${CONFIG} -c -q (code=exited, status=1/FAILURE)
  Main PID: 9883 (code=exited, status=0/SUCCESS)

Jun 18 13:09:04 host systemd[1]: Failed to start HAProxy Load Balancer.
Jun 18 13:09:04 host systemd[1]: Unit haproxy.service entered failed state.
Jun 18 13:09:04 host systemd[1]: haproxy.service holdoff time over, scheduling restart.
Jun 18 13:09:04 host systemd[1]: Stopping HAProxy Load Balancer...
Jun 18 13:09:04 host systemd[1]: Starting HAProxy Load Balancer...
Jun 18 13:09:04 host systemd[1]: haproxy.service start request repeated too quickly, refusing to start.
Jun 18 13:09:04 host systemd[1]: Failed to start HAProxy Load Balancer.
Jun 18 13:09:04 host systemd[1]: Unit haproxy.service entered failed state.

What am I doing wrong ?

2
haproxy
The first thing you need to do is figure out how to persuade the steaming garbage heap known as "systemd" to actually stop suppressing what HAProxy is trying to tell you about why it is failing to start. I assume this will involve some cryptic incantation of journalctl. - Michael - sqlbot

2 Answers

0
votes

Haproxy only knows how to log to a syslog socket / daemon. You will need to tag (with the log-tag directive, probably on a backend) your logs, and configure your syslog daemon to log to a file the entries matching the previsouly defined tag.

0
votes

I'm new to HAproxy. I have turned on basicauth on backend server and I wanted to see in HAprogxy log who is making requests.

I have done it like this:
on backend part, I have set varible txn.user:

http-request set-var(txn.user) http_auth_group(myuserlist)

Of course you need to have myuserlist, but this is easy.
In fronted I have added this variable (%[var(txn.user)]) to my custom log:

log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r [%[var(txn.user)]]"

I can now see IP address, user agent, request URL and HAProxy basic authentication username.

Just for fun (since I'm using basic http server busybox, 20k in size):
on backend I have added:

http-response set-header Set-Cookie user=%[var(txn.user)];path=/;SameSite=strict;Secure

and inside html I read this cookie with javascript and show on page who is loged in :)