# About haproxy log

**URL:** <https://discourse.haproxy.org/t/about-haproxy-log/8659>\
**Category:** Help!\
**Created:** [April 28, 2023, 6:25am UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659 "2023-04-28T06:25:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cheesewizz](https://avatars.discourse-cdn.com/v4/letter/c/97f17d/32.png) [@cheesewizz](https://discourse.haproxy.org/u/cheesewizz)\
**Post date:** [April 28, 2023, 6:25am UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659/1 "2023-04-28T06:25:22Z")

</div>

Good day

i am newbie here  
just want to ask why my haproxy log shows only few info

sample:  
[root@BLoadB log]# tail -F haproxy.log  
Apr 28 11:13:54 localhost haproxy[2013]: Proxy t2apps started.  
Apr 28 11:13:54 localhost haproxy[2013]: Proxy dtrapps started.  
Apr 28 11:13:54 localhost haproxy[2013]: Proxy acpsapps started.  
Apr 28 11:13:54 localhost haproxy[2013]: Proxy chopchopapps started.

 ![samplehaproxy](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/8/8b813ca3a0ed47b79a6a310b7b804faa29aef388.jpeg)

I just want to see on log with destination IP and client IP address etc…

here is my haproxy config

```auto
global
    log /dev/log local0 info
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    pidfile /var/run/haproxy.pid
    maxconn 4000
    user haproxy
    group haproxy
    daemon

## stats socket /var/lib/haproxy/stats

## ssl-default-bind-ciphers PROFILE=SYSTEM
## ssl-default-server-ciphers PROFILE=SYSTEM

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor except 127.0.0.0/8
    option redispatch
    retries 3
    timeout http-request 10s
    timeout queue 1m
    timeout connect 10s
    timeout client 1m
    timeout server 1m
    timeout http-keep-alive 10s
    timeout check 10s
    maxconn 3000

   stats enable
   stats hide-version
   stats realm Haproxy Statistics
   stats uri /haproxy_stats
   stats auth admin:admin

frontend main

    maxconn 20000
    bind 192.168.50.250:80
    use_backend t2apps if { hdr(host) -i t2apps.haproxy.stp1 }
    use_backend dtrapps if { hdr(host) -i dtr.haproxy.stp1 }
    use_backend acpsapps if { hdr(host) -i acps.haproxy.stp1 }

backend t2apps
# mode http
# option httplog
    balance roundrobin
    server t2apps1 172.16.31.249:3000 check
    server t2apps2 172.16.31.248:3000 check

backend dtrapps
# mode http
# option httplog
    balance roundrobin
    server acps1 192.168.50.20:4070 check

```

Thanks

---

<div class="post-metadata">

**Author:** ![MaEh86](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@MaEh86](https://discourse.haproxy.org/u/MaEh86)\
**Post date:** [May 2, 2023, 1:54pm UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659/2 "2023-05-02T13:54:47Z")

</div>

> **[Introduction to HAProxy Logging](https://www.haproxy.com/blog/introduction-to-haproxy-logging)**
>
> In this blog post, we show how to set up HAProxy logging, target a Syslog server, understand the log fields, and suggest helpful tools for parsing log files.

Especially, the following section seems interesting for you:

> However, you should keep in mind that if you’re going to use a UNIX socket for logging and at the same time you are running HAProxy within a chrooted environment—or you let HAProxy create a chroot directory for you by using the chroot configuration directive—then the UNIX socket must be made available within that chroot directory. This can be done in one of two ways.
> 
> First, when rsyslog starts up, it can create a new listening socket within the chroot filesystem. Add the following to your HAProxy rsyslog configuration file:

```auto
$ModLoad imuxsock
$AddUnixListenSocket /var/lib/haproxy/dev/log

```

best regards,  
Markus

---

<div class="post-metadata">

**Author:** ![cheesewizz](https://avatars.discourse-cdn.com/v4/letter/c/97f17d/32.png) [@cheesewizz](https://discourse.haproxy.org/u/cheesewizz)\
**Post date:** [May 4, 2023, 1:00am UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659/3 "2023-05-04T01:00:48Z")

</div>

Hello Maeh86

Thanks for your reply

but i still get same output on my 2 log file which is haproxy-traffic.log and haproxy-admin.log

both logfile same output

![2logfile](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/7/796c62ed4cf7046bb3751c4d5e1236331cf26fb2.jpeg)  
nano /var/log/haproxy-traffic.log

```auto

May 4 08:12:11 localhost haproxy[6486]: Proxy acpsapps started.
May 4 08:12:11 localhost haproxy[6486]: Proxy chopchopapps started.
May 4 08:12:11 localhost haproxy[6486]: Proxy no_route started.
May 4 08:24:06 localhost haproxy[6537]: Proxy main started.
May 4 08:24:06 localhost haproxy[6537]: Proxy main started.
May 4 08:24:06 localhost haproxy[6537]: Proxy t2apps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy dtrapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy acpsapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy chopchopapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy no_route started.
May 4 08:25:57 localhost haproxy[6551]: Proxy main started.
May 4 08:25:57 localhost haproxy[6551]: Proxy main started.
May 4 08:25:57 localhost haproxy[6551]: Proxy t2apps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy dtrapps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy acpsapps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy chopchopapps started.

```

nano /var/loghaproxy-admin.log

```auto
May 4 08:24:06 localhost haproxy[6537]: Proxy dtrapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy acpsapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy chopchopapps started.
May 4 08:24:06 localhost haproxy[6537]: Proxy no_route started.
May 4 08:25:57 localhost haproxy[6551]: Proxy main started.
May 4 08:25:57 localhost haproxy[6551]: Proxy main started.
May 4 08:25:57 localhost haproxy[6551]: Proxy t2apps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy dtrapps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy acpsapps started.
May 4 08:25:57 localhost haproxy[6551]: Proxy chopchopapps started.

```

i have modified some in my /etc/haproxy/haproxy.cfg and /etc/rsyslog.d/haproxy.conf

for haproxy.cfg

```auto
global
    log 127.0.0.1:514 local0
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    stats socket /var/lib/haproxy/stats
    master-worker

defaults
    log global
    mode http
    timeout connect 5000
    timeout client 50000
    timeout server 50000

   log-format "%ci:%cp [%tr] %ft %b/%s %Th/%Ti/%TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %{+Q}r %[capture.req.hdr(0)]"

   stats enable
   stats hide-version
   stats realm Haproxy Statistics
   stats uri /haproxy_stats
   stats auth admin:admin

frontend main
    log 127.0.0.1 local0 notice
    bind 192.168.50.250:80

    use_backend t2apps if { hdr(host) -i t2apps.tailinsubic.server }
    use_backend dtrapps if { hdr(host) -i dtr.tailinsubic.server }
    use_backend acpsapps if { hdr(host) -i acps.tailinsubic.server }
    use_backend chopchopapps if { hdr(host) -i chopchop.tailinsubic.server }

backend t2apps
    balance roundrobin
    server t2apps1 172.16.31.249:3000 check
    server t2apps2 172.16.31.248:3000 check

backend dtrapps
    balance roundrobin
    server dtr1 172.16.31.241:5083 check
    server dtr2 172.16.31.235:5084 check

backend acpsapps
    balance roundrobin
    server acps1 192.168.50.20:4070 check

backend chopchopapps
    balance roundrobin
    server chochop1 172.16.31.241:5084 check
    server chopchop2 172.16.31.235:5083 check

```

for haproxy.conf

```auto
# Collect log with UDP
$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514

# Creating separate log files based on the severity
local0.* /var/log/haproxy-traffic.log
local0.notice /var/log/haproxy-admin.log

```

then i created folder for admin.sock mkdir -p /run/haproxy/

when i restart two service haproxy.service and rsyslog.service it was successfully restarted with no errors

but i still get same output on the two log files.

thanks

---

<div class="post-metadata">

**Author:** ![MaEh86](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@MaEh86](https://discourse.haproxy.org/u/MaEh86)\
**Post date:** [May 4, 2023, 10:33am UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659/4 "2023-05-04T10:33:44Z")

</div>

Here is my configuration:

**/etc/haproxy/haproxy.cfg**

```auto
global
        log /dev/log local0 info
        log /dev/log local1 info
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats socket /var/lib/haproxy/stats
        stats timeout 30s
        user haproxy
        group haproxy
        daemon
[...]
defaults
        log global
        mode http
        option httplog
        option dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http 
[...]

```

**/etc/rsyslog.d/49-haproxy.conf**

```auto
# Create an additional socket in haproxy's chroot in order to allow logging via
# /dev/log to chroot'ed HAProxy processes
$AddUnixListenSocket /var/lib/haproxy/dev/log

# Send HAProxy messages to a dedicated logfile
:programname, startswith, "haproxy" {
  /var/log/haproxy.log
  stop
}

```

best regards,  
Markus

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 4, 2023, 1:54pm UTC](https://discourse.haproxy.org/t/about-haproxy-log/8659/5 "2023-05-04T13:54:22Z")

</div>

I suggest you put all your logging configuration into your global/defaults section, more specifically I suggest you don’t reconfigure logging in your main frontend.

When you log via UDP sockets and you don’t know if haproxy doesn’t send the logs or rsyslog doesn’t put them into the right place, tcdpump it and check:

```
tcpdump -i lo -vvvvs0 udp port 514

```

You should put `option httplog` in your defaults.

If you filter syslog message at a specific level, then less important syslog message will not be send.

E.g. if you sepcify “notice” as your max-level, you will never see “info” level message (which is what connections logs have). You you need to make sure that you don’t filter those message, neither in haproxy and rsyslog.