0

So I've got an Ubuntu 20.04 LTS server setup with Haproxy and I'm trying to fwd log info to Splunk Cloud.

I have the Haproxy.cfg with a Global entry:

log 127.0.0.1 local4

And I've got an entry in /etc/rsyslog.conf for the remote server:

*.* @@10.1.1.1:1603

(The @@ is for TCP and yeah I'm using a non-standard port that was assigned to me for this by InfoSec)

The latest versions of Haproxy create it's own rsyslog config file /etc/rsyslog.d/hapyoxy.log with:

# Create an additional socket in haproxy's chroot in order to allow logging via
# /dev/log to chroot'ed HAProxy processes $AddUnixListenSocket /var/lib/haproxy/dev/log

# Send HAProxy messages to a dedicated logfile :programname, startswith, "haproxy" {   /var/log/haproxy.log   stop }

And finally I've added a line to /etc/rsyslog.d/50-default.conf:

local4.* /var/log/haproxy.log

So I believe I've got it all setup how it should be, so I run logger "please work" and I can see that line when I: tail /var/log/haproxy.log and tail /var/log/syslog but nothing on the remote end. So then I try: logger -n 10.1.1.1 -P 1603 "please really work" but I don't see that line in any log file or the remote side.

So I REALLY hope I've just overlooked something simple. Any help would be dramatically appreciated.

##EDIT##

So using TCPdump and 'logger' I am able to send events to Splunk. But Haproxy to syslog still doesn't work.

4
  • Eh that's a typo from posting it here. Fixing it now.
    – Skeer
    Jun 30, 2021 at 14:29
  • Are you running HAProxy inside a chroot or docker environment?
    – meuh
    Jun 30, 2021 at 14:42
  • HAproxy is, I guess the default config which I believe for a full OS is chroot'd.
    – Skeer
    Jul 14, 2021 at 15:13
  • You say there is a /etc/rsyslog.d/hapyoxy.log file, and you show its contents, but we see only 3 lines, all starting with #, so they are just comments. Do you have a newline before the words $AddUnixListenSocket and :programname or not? If not, then you should probably add the correct newlines so that this configuration is applied, and restart rsyslogd. If you then get local4 logs from haproxy, you need to move the *.* @@10.1.1.1:1603 line into this file before the stop line.
    – meuh
    Jul 14, 2021 at 17:36

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.