Exclude localhost.localdomain and haproxy[PID] from haproxy logfile

Most system admins do not utilize the full potential of a well-formatted HAProxy log file. The default log usually appears unclear and unreadable. Here’s an example:

2024-11-19T20:13:01+01:00 localhost.localdomain haproxy[10162]: 192.168.1.13:47708 [19/Nov/2024:20:13:01.155] frontend_proxy/backend_name1/-1/0 412 -- 2/1/0/0/0 0/0

To make the log file readable, remove localhost.localdomain and haproxy[PID number].

1. Start by configuring the rsyslog for HAProxy. Go to:

cd /etc/rsyslog.d/

2. Create the rsyslog haproxy.conf file:

vi /etc/rsyslog.d/

3. Paste the following configuration:

# Template to include only the timestamp in HAProxy logs
template(name="HaproxyTimestampOnly" type="string" string="%timegenerated% %msg:::drop-last-lf%\n")

# Apply the template to HAProxy logs
if $programname startswith 'haproxy' then /var/log/haproxy.log;HaproxyTimestampOnly
& stop

4. After creating the configuration file, adjust the HAProxy log format like this:

log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ %{+Q}r

Key parts of the logfile format include:

• %ci Client IP address
• %cp Client port number
• %H Host name
• [%t] Timestamp when the log line was generated, typically in the format enclosed by square brackets
• %f frontend name
• %b backend name
• %s server name
• %Tw Total time in milliseconds spent waiting in the various queues
• %Tc Total time in milliseconds spent waiting for the connection to establish to the final server
• %Tt Total time in milliseconds it took to process the request from the client, get a response, and send it back to the client
• %B Total bytes sent for the body of the request (excluding headers)
• %ts Termination state indicating how the session was terminated, such as timeouts or connection errors
• %ac  Active connections
• %fc Frontend connections (how many connections are currently being handled by the frontend).
• %bc Backend connections (how many connections are currently being handled by the backend).
• %sc Server connections (how many connections are currently being handled by the server)
• %sq Server queue length (number of requests waiting to be processed by a server).
• %bq Backend queue length (number of requests waiting in the backend queue)

5. Restart the rsyslog service:

systemctl restart rsyslog.service


6. After following these steps, the final format of the HAProxy log will look like this:

Nov 19 22:33:49 192.168.1.30:50258 hostname [19/Nov/2024:22:28:49.181] [frontend_name 10.46.108.6:61345] [backend_name/bk_host 192.168.1.40:61345] 1/0/300107 53 -- 63/13/12/3/0/0

And that’s the final step to improve your HAProxy log format. I hope this guide helps! Enjoy your new format. 🙂