[SOLVED] Migrating Haproxy 1.5.8 to 1.7.5

qwrty · July 27, 2018, 1:33pm

Hello there,

I’m running Haproxy for a while now, after doing my Debian migration from Jessie to Stretch, Debian update Haproxy package, BUT my Haproxy 1.5.8-3+deb8u1 configuration does not work anymore on the Stretch candidate version 1.7.5-2.

So I came back to my old Haproxy package and block the package from upgrade.

This is my Haproxy configuration which works great on 1.5.8-3+deb8u1:

https://pastebin.com/9Asky63c

FYI:

I used my own certificate that I concatenated like this:

1# Private KEY
2# Certificat Own Domain
3#IntermediateCA
4#RootCA

Any idea why the same configuration does not work with newer version of Haproxy ?

Thank you !

yakatz · July 27, 2018, 2:04pm

When you say “does not work”, does it not start? Does it not handle connections?

Do you get an error message?

qwrty · July 27, 2018, 2:06pm

Hi,

thank you for answering me

Haproxy does not start.

I will search for error log.

qwrty · July 27, 2018, 2:24pm

I do not have the log anymore

But what’s is the problem with my configuration file ?
Maybe some options change between this two version ?

If nothing seems wrong I will update Haproxy and fetch log.

qwrty · July 30, 2018, 7:11am

Some news.

This weekend I tried to install 1.7.5 or 1.8 version from backport repo, configuration seems OK after check it with -c option, so Haproxy start well.

BUT for some backend (like webmin or plex for example), I have a 503 error…

Configuration is exactly the same as 1.5, backend is up and running (with 1.5 it works just great)

here the log error:

Jul 29 18:54:55 LINOLOGY haproxy[21311]: 80.12.58.230:56257 [29/Jul/2018:18:54:55.298] https~ plex/ 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 “GET /web/index.html HTTP/1.1”
Jul 29 18:55:22 LINOLOGY haproxy[21311]: 80.12.58.230:56293 [29/Jul/2018:18:55:22.308] https~ plex/ 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 “GET /web/index.html HTTP/1.1”
Jul 29 18:56:21 LINOLOGY haproxy[21311]: 80.12.58.230:56299 [29/Jul/2018:18:56:21.077] https~ webmin/ 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 “GET / HTTP/1.1”
Jul 29 18:56:21 LINOLOGY haproxy[21311]: 80.12.58.230:56300 [29/Jul/2018:18:56:21.337] https~ webmin/ 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 “GET /favicon.ico HTTP/1.1”

When it’s OK with 1.5 version:

Jul 29 19:06:41 LINOLOGY haproxy[12463]: 80.12.58.230:56335 [29/Jul/2018:19:06:41.748] https~ plex/plex 159/0/1/2/162 200 9655 - - ---- 1/1/0/1/0 0/0 “GET /web/index.html HTTP/1.1”

Why I get this 503 with HAproxy version above 1.5 ?

lukastribus · July 30, 2018, 9:55am

The SC code means haproxy cannot accessa the backend:

 SC   The server or an equipment between it and haproxy explicitly refused
      the TCP connection (the proxy received a TCP RST or an ICMP message
      in return). Under some circumstances, it can also be the network
      stack telling the proxy that the server is unreachable (eg: no route,
      or no ARP response on local network). When this happens in HTTP mode,
      the status code is likely a 502 or 503 here.

Can you share the startup log and confirm haproxy actually sees the backend up (since you enable healthcheck).

Can you try without the check keyword (healthcheck doesn’t make a lot of sense anyway when you only have one backend server, you seem to be using haproxy for content switching only (not load balancing).

qwrty · July 30, 2018, 10:16am

Hello,

yes, I only use Haproxy for content switching.

Here the full start log:

Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy http started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy http started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy https started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy https started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy subsonic started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy subsonic started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy emby started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy emby started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy plex started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy plex started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy pyload started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy pyload started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy webmin started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy webmin started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy nas started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy nas started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy www started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy www started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy pydio started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy pydio started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy transmission started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy transmission started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy awstats started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy awstats started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy cvvtg started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy cvvtg started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy speedtest started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy speedtest started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy ts3wi started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy ts3wi started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy plexpy started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy plexpy started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy aria2c started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy aria2c started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy live started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy live started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy ombi started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy ombi started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy webmail started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy webmail started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy stats started.
Jul 29 17:34:20 LINOLOGY haproxy[19594]: Proxy stats started.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server plex/plex is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server plex/plex is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend plex has no server available!
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend plex has no server available!
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server pyload/pyload is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server pyload/pyload is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend pyload has no server available!
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend pyload has no server available!
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server webmin/webmin is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: Server webmin/webmin is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend webmin has no server available!
Jul 29 17:34:20 LINOLOGY haproxy[19595]: backend webmin has no server available!
Jul 29 17:34:21 LINOLOGY haproxy[19595]: Server transmission/transmission is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:21 LINOLOGY haproxy[19595]: Server transmission/transmission is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:21 LINOLOGY haproxy[19595]: backend transmission has no server available!
Jul 29 17:34:21 LINOLOGY haproxy[19595]: backend transmission has no server available!
Jul 29 17:34:21 LINOLOGY haproxy[19595]: Server plexpy/plexpy is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:21 LINOLOGY haproxy[19595]: Server plexpy/plexpy is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:21 LINOLOGY haproxy[19595]: backend plexpy has no server available!
Jul 29 17:34:21 LINOLOGY haproxy[19595]: backend plexpy has no server available!
Jul 29 17:34:22 LINOLOGY haproxy[19595]: Server live/live is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:22 LINOLOGY haproxy[19595]: Server live/live is DOWN, reason: Layer4 connection problem, info: “Connection refused”, check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 29 17:34:22 LINOLOGY haproxy[19595]: backend live has no server available!
Jul 29 17:34:22 LINOLOGY haproxy[19595]: backend live has no server available!

I did not see this log when I launch Haproxy, but the server mentionned are the server I can’t reach.

But same question, why on 1.5 my configuration works perfectly ?

I will try with check option removed.

lukastribus · July 30, 2018, 10:40am

Its possible haproxy 1.7 was compiled with USE_GETADDRINFO=1 and haproxy 1.5 was not, so localhost also resolves to its IPv6 equivilant ::1, where some applications don’t listen.

Try replacing localhost with 127.0.0.1

qwrty · July 30, 2018, 11:04am

Ok, I see, will try this tip and come back here to tell if it’s work or not !

But some backend server are working great, just a few don’t work with 1.7 or higher

Thank you !

lukastribus · July 30, 2018, 2:26pm

Because some backends listen to IPv6 as well, and others don’t.

qwrty · July 30, 2018, 3:16pm

It works !

Thank you very much for your time

Topic		Replies	Views
Upgrading Haproxy 1.5.18 to 1.7.x or 1.8.x Help!	5	6512	January 29, 2018
Haproxy 1.7.10 upgrade to 1.8.15 fails to start Help!	5	2742	January 10, 2019
Config not working after upgrade from 1.5 to 1.8.13 (pfsense upgrade to 2.4.4) Help!	2	1475	October 4, 2018
Redirect to site do not work correctly Help!	1	2306	February 2, 2016
HAProxy not starting with ssl configuration Help!	6	21472	March 6, 2019

[SOLVED] Migrating Haproxy 1.5.8 to 1.7.5

Related topics