Trying to get HaProxy to log specific HTTP headers to custom file - haproxy

Question

I'm using HaProxy as a reverse proxy and load balancer for three servers. Each of these servers uses Basic Authentication to control access to them and HaProxy shares the load across them via a round-robin method.
I'd like to log the IP address, user agent, request URL and Basic Authentication username for each request that HaProxy handles and to log this to a custom file so that another script can check periodically to ensure that credentials are not be shared by my users.
It looks like this possible to do but I cannot work out how to do it.
Here's what I've added to my haproxy.cfg file in my frontend section:
# Log name of server
capture request header Host len 500
# Capture request user agent
capture request header User-Agent len 64
# Capture authorization details
capture request header Authorization len 64
log-format "%ci:%cp [%t] %H %HP %hr %hrl"
When I include this in my haproxy.cfg file I and restart the service HaProxy fails to start. Looking in 'systemctl status haproxy.service' results in:
haproxy.service - HAProxy Load Balancer
Loaded: loaded (/lib/systemd/system/haproxy.service; enabled)
Active: failed (Result: start-limit) since Mon 2018-06-18 13:09:04 BST; 18s ago
Docs: man:haproxy(1)
file:/usr/share/doc/haproxy/configuration.txt.gz
Process: 25529 ExecReload=/bin/kill -USR2 $MAINPID (code=exited, status=0/SUCCESS)
Process: 25527 ExecReload=/usr/sbin/haproxy -c -f ${CONFIG} (code=exited, status=0/SUCCESS)
Process: 9883 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f ${CONFIG} -p /run/haproxy.pid $EXTRAOPTS (code=exited, status=0/SUCCESS)
Process: 10644 ExecStartPre=/usr/sbin/haproxy -f ${CONFIG} -c -q (code=exited, status=1/FAILURE)
Main PID: 9883 (code=exited, status=0/SUCCESS)
Jun 18 13:09:04 host systemd[1]: Failed to start HAProxy Load Balancer.
Jun 18 13:09:04 host systemd[1]: Unit haproxy.service entered failed state.
Jun 18 13:09:04 host systemd[1]: haproxy.service holdoff time over, scheduling restart.
Jun 18 13:09:04 host systemd[1]: Stopping HAProxy Load Balancer...
Jun 18 13:09:04 host systemd[1]: Starting HAProxy Load Balancer...
Jun 18 13:09:04 host systemd[1]: haproxy.service start request repeated too quickly, refusing to start.
Jun 18 13:09:04 host systemd[1]: Failed to start HAProxy Load Balancer.
Jun 18 13:09:04 host systemd[1]: Unit haproxy.service entered failed state.
What am I doing wrong ?

Answer 1

I'm new to HAproxy. I have turned on basicauth on backend server and I wanted to see in HAprogxy log who is making requests.
I have done it like this:on backend part, I have set varible txn.user:
http-request set-var(txn.user) http_auth_group(myuserlist)
Of course you need to have myuserlist, but this is easy.
In fronted I have added this variable (%[var(txn.user)]) to my custom log:
log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r [%[var(txn.user)]]"
I can now see IP address, user agent, request URL and HAProxy basic authentication username.
Just for fun (since I'm using basic http server busybox, 20k in size):
on backend I have added:
http-response set-header Set-Cookie user=%[var(txn.user)];path=/;SameSite=strict;Secure
and inside html I read this cookie with javascript and show on page who is loged in :)

Answer 2

Haproxy only knows how to log to a syslog socket / daemon.
You will need to tag (with the log-tag directive, probably on a backend) your logs, and configure your syslog daemon to log to a file the entries matching the previsouly defined tag.