I’ve been seeing about 2% of ips in my Haproxy log that are not in my Apache log.
I’ve set a header at the end of my backend and recorded it in the haproxy log:
"
backend http-backend
guid 9de9a5de-c3c2-47c4-b945-c4f61b7ece6b
option httpchk
http-request set-var("txn.debug") str("backend1")
# Forward HTTPS traffic to Apache on port 8443
server apache-https 127.0.0.1:8443 ssl alpn h2,http/1.1 verify none check maxconn 50 maxqueue 20
http-request set-var("txn.debug") str("backend2")
backend q_backend
"
the entries in the haproxy log have the value backend2, indicating that Haproxy processing made it through everything and there is no further haproxy processing except to pass it to Apache.
Here’s are some of the log entries:
2025-03-08T07:13:05.355822-05:00 y0g5 haproxy[1553669]: 138.68.40.221:56056 [08/Mar/2025:07:13:05.144] http-frontend~ http-backend/apache-https 0/6/+210 +426 – 3/3/1/0/0 0/0 country: US count: 6 page_count: 4- asset_count: 0, mod_url: - curr: 1 rate: 19 delay: 0 bot: - - unknown http-frontend~/http-backend backend2 -
2025-03-08T07:13:05.632930-05:00 y0g5 haproxy[1553669]: 138.68.40.221:45834 [08/Mar/2025:07:13:05.477] http-frontend~ http-backend/apache-https 0/7/+154 +554 – 5/5/1/0/0 0/0 country: US count: 7 page_count: 5- asset_count: 0, mod_url: - curr: 1 rate: 20 delay: 0 bot: - - unknown http-frontend~/http-backend backend2 -
2025-03-08T07:13:05.934247-05:00 y0g5 haproxy[1553669]: 138.68.40.221:45844 [08/Mar/2025:07:13:05.791] http-frontend~ http-backend/apache-https 0/3/+141 +426 – 4/4/1/0/0 0/0 country: US count: 8 page_count: 6- asset_count: 0, mod_url: - curr: 1 rate: 21 delay: 0 bot: - - unknown http-frontend~/http-backend backend2 -
2025-03-08T07:13:20.974553-05:00 y0g5 haproxy[1553669]: 72.14.199.39:52550 [08/Mar/2025:07:13:20.896] http-frontend~ http-backend/apache-https 0/5/+78 +428 – 2/2/1/0/0 0/0 country: US count: 7 page_count: 7+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
2025-03-08T07:13:25.214409-05:00 y0g5 haproxy[1553669]: 72.14.199.37:51186 [08/Mar/2025:07:13:25.131] http-frontend~ http-backend/apache-https 0/7/+82 +428 – 2/2/1/0/0 0/0 country: US count: 5 page_count: 5+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
2025-03-08T07:24:23.568848-05:00 y0g5 haproxy[1553669]: 206.168.34.195:45266 [08/Mar/2025:07:24:17.739] http-frontend~ http-backend/apache-https 0/7/+5829 +554 – 3/3/1/0/0 0/0 country: US count: 1 page_count: 1- asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - - about.censys.io http-frontend~/http-backend backend2 -
2025-03-08T07:25:16.913537-05:00 y0g5 haproxy[1553669]: 206.168.34.195:48750 [08/Mar/2025:07:25:14.763] http-frontend~ http-backend/apache-https 0/4/+2149 +426 – 3/3/1/0/0 0/0 country: US count: 3 page_count: 1- asset_count: 0, mod_url: - curr: 1 rate: 7 delay: 0 bot: - - about.censys.io http-frontend~/http-backend backend2 -
2025-03-08T07:28:57.165740-05:00 y0g5 haproxy[1553669]: 54.191.183.110:48666 [08/Mar/2025:07:28:57.077] http-frontend~ http-backend/apache-https 0/8/+88 +554 – 3/3/1/0/0 0/0 country: US count: 2 page_count: 1- asset_count: 0, mod_url: - curr: 2 rate: 2 delay: 0 bot: - - unknown http-frontend~/http-backend backend2 -
2025-03-08T07:28:57.372878-05:00 y0g5 haproxy[1553669]: 54.191.183.110:48676 [08/Mar/2025:07:28:57.294] http-frontend~ http-backend/apache-https 0/4/+77 +554 – 4/4/1/0/0 0/0 country: US count: 3 page_count: 2- asset_count: 0, mod_url: - curr: 3 rate: 3 delay: 0 bot: - - unknown http-frontend~/http-backend backend2 -
2025-03-08T07:42:29.138014-05:00 y0g5 haproxy[1553669]: 17.241.227.207:38368 [08/Mar/2025:07:42:28.862] http-frontend~ http-backend/apache-https 0/8/+274 +428 – 7/7/1/0/0 0/0 country: US count: 1 page_count: 0+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: applebot + www.apple.com http-frontend~/http-backend backend2 -
2025-03-08T07:42:29.438135-05:00 y0g5 haproxy[1553669]: 17.241.227.207:38368 [08/Mar/2025:07:42:29.137] http-frontend~ http-backend/apache-https 0/0/+300 +428 – 7/7/1/0/0 0/0 country: US count: 2 page_count: 0+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: applebot + www.apple.com http-frontend~/http-backend backend2 -
2025-03-08T07:43:49.297611-05:00 y0g5 haproxy[1553669]: 72.14.199.39:55049 [08/Mar/2025:07:43:49.213] http-frontend~ http-backend/apache-https 0/7/+83 +428 – 2/2/1/0/0 0/0 country: US count: 8 page_count: 8+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
2025-03-08T07:49:49.155202-05:00 y0g5 haproxy[1553669]: 72.14.199.39:51132 [08/Mar/2025:07:49:49.077] http-frontend~ http-backend/apache-https 0/5/+77 +428 – 4/4/1/0/0 0/0 country: US count: 9 page_count: 9+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
2025-03-08T07:49:52.984599-05:00 y0g5 haproxy[1553669]: 72.14.199.37:57278 [08/Mar/2025:07:49:52.901] http-frontend~ http-backend/apache-https 0/4/+82 +428 – 4/4/1/0/0 0/0 country: US count: 6 page_count: 6+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
2025-03-08T07:49:57.109591-05:00 y0g5 haproxy[1553669]: 72.14.199.37:57278 [08/Mar/2025:07:49:52.984] http-frontend~ http-backend/apache-https 0/4/+4124 +428 – 5/5/1/0/0 0/0 country: US count: 7 page_count: 7+ asset_count: 0, mod_url: - curr: 1 rate: 1 delay: 0 bot: - + www.google.com http-frontend~/http-backend backend2 -
There are no errors in the haproxy log. Again, althrough there are 100x as many nearly identical successful requests. Unlike the others, these haproxy logged ips are non logged at all in my Apache log. Can anyone inform me how to find out where these requests are dropped?
.