Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use HAProxy 1.3.26 on my CentOS 5.8 to proxy all requests to a dedicated server. I use HAProxy just to proxy HTTP and HTTPS to a single server, so no load balancing.

My haproxy.cfg is rather simple:

        log   local0
        log   local1 notice
        maxconn 4096
        user haproxy
        group haproxy

        log global
        option dontlognull
        option httpclose
        option forwardfor
        clitimeout 60000
        srvtimeout 60000
        contimeout 5000
        retries 3
        option redispatch

listen http
        mode tcp
        option tcplog
        maxconn 10000
        server web01 maxconn 5000

listen https
        mode tcp
        maxconn 10000
        server web01 maxconn 5000

where: - server where HAProxy is installed  - server to which HTTP requests are forwarded

I would like to see the clients' IP addresses in my Apache 2.2.3 access logs. This option is usually achieved by adding the HTTP X-Forwarded-For header and then reading it in the web server logs. So, I've added the following lines to httpd.conf:

LogFormat "%h %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_forwarded
SetEnvIfNoCase X-Forwarded-For "." from_proxy=1
CustomLog logs/access_log combined env=!from_proxy
CustomLog logs/access_log combined_forwarded env=from_proxy

The problem is the only logged IP address is (HAProxy server). I've tried different configurations, read documentation, googled but still can't understand why the clients' IPs are not logged.

I feel like I'm missing something simple, as the configs are very straightforward. Please help to correct the configs if possible.

Thank you for any help.

share|improve this question
Seems like the SetEnvIfNoCase is never triggering. Can you try ditching the conditionals on that, make all logging occur in the combined_forwarded format, and see what's logged? – Shane Madden May 18 '12 at 0:41
And also make the two log formats differ in some other aspect, just in order to be absolutely sure which of the two shows (it's conceivable the second shows, but X-Forwarded-For could somehow be the haproxy's IP address), and use tcpdump to sniff the traffic between haproxy and apache to see whether the x-forwarded-for header is ok. – Antonis Christofides May 18 '12 at 7:02
up vote 1 down vote accepted

Please do not forget that this will not work for the https proxy since haproxy will not be able to mangle the contents of an encrypted session. You might also want to check the mod_rpaf module for Apache which makes all this easier.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.