Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use HAProxy 1.3.26 on my CentOS 5.8 to proxy all requests to a dedicated server. I use HAProxy just to proxy HTTP and HTTPS to a single server, so no load balancing.

My haproxy.cfg is rather simple:

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        maxconn 4096
        user haproxy
        group haproxy
        daemon

defaults
        log global
        option dontlognull
        option httpclose
        option forwardfor
        clitimeout 60000
        srvtimeout 60000
        contimeout 5000
        retries 3
        option redispatch

listen http 192.168.0.1:80
        mode tcp
        option tcplog
        maxconn 10000
        server web01 192.0.1.13:80 maxconn 5000

listen https 192.168.0.1:443
        mode tcp
        maxconn 10000
        server web01 192.0.1.13:443 maxconn 5000

where:

192.168.0.1 - server where HAProxy is installed
192.0.1.13  - server to which HTTP requests are forwarded

I would like to see the clients' IP addresses in my Apache 2.2.3 access logs. This option is usually achieved by adding the HTTP X-Forwarded-For header and then reading it in the web server logs. So, I've added the following lines to httpd.conf:

LogFormat "%h %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_forwarded
SetEnvIfNoCase X-Forwarded-For "." from_proxy=1
CustomLog logs/access_log combined env=!from_proxy
CustomLog logs/access_log combined_forwarded env=from_proxy

The problem is the only logged IP address is 192.168.0.1 (HAProxy server). I've tried different configurations, read documentation, googled but still can't understand why the clients' IPs are not logged.

I feel like I'm missing something simple, as the configs are very straightforward. Please help to correct the configs if possible.

Thank you for any help.

share|improve this question
1  
Seems like the SetEnvIfNoCase is never triggering. Can you try ditching the conditionals on that, make all logging occur in the combined_forwarded format, and see what's logged? –  Shane Madden May 18 '12 at 0:41
1  
And also make the two log formats differ in some other aspect, just in order to be absolutely sure which of the two shows (it's conceivable the second shows, but X-Forwarded-For could somehow be the haproxy's IP address), and use tcpdump to sniff the traffic between haproxy and apache to see whether the x-forwarded-for header is ok. –  Antonis Christofides May 18 '12 at 7:02

1 Answer 1

up vote 1 down vote accepted

Please do not forget that this will not work for the https proxy since haproxy will not be able to mangle the contents of an encrypted session. You might also want to check the mod_rpaf module for Apache which makes all this easier.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.