Syslog messages being double-tagged localhost AND hostname


#1

Hi!

I’m getting strange behaviour with haproxy-1.5.14-3.el7.x86_64 on CentOS 7…

I’ve set haproxy to log to syslog with the following lines in the global section of my haproxy.cfg:

log         127.0.0.1 local2
log-send-hostname

This works fine on an Amazon Linux 6 server with haproxy-1.5.2-2.5.amzn1.x86_64 and I get lines like the following in /var/adm/messages:

Oct 12 16:10:13 server1.myco.co haproxy[31181]: 10.20.0.241:61599,[12/Oct/2016:16:10:12.848],haproxy-fe-8002,haproxy-be-v4-80/V41,602/0/1/13/616,200,5253,-,-,–VN,19/19/0/1/0,0/0,{amp.myco.com|66|Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 |http://amp.myco},“POST /j_security_check HTTP/1.1”,10.20.2.9:8002-10.20.2.9:47656

…all good!

But using the identical config (haproxy.cfg same checksum) on CentOS 7 the messages are logged to /var/adm/messages with both “localhost” and hostname, like:

Oct 12 15:55:59 localhost server2.myco. haproxy[17886]: 10.20.3.226:49153,[12/Oct/2016:15:55:10.743],haproxy-fe-8002,haproxy-be-v5-80/V51a,48567/0/1/2/48570,200,2446,-,-,–NN,12/12/0/0/0,0/0,{amp.myco.com||Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like |},“GET /ecc/ HTTP/1.1”,10.20.1.180:8002-10.20.1.180:52253

This one has me stumped - is there someting I’m missing?

thanks for looking!


#2

I suggest you compare the actual syslog message:

tcpdump -ps0 -i lo port syslog