2

I've seen several examples (see below) of HAProxy logging configuration that all look like this:

/etc/haproxy/haproxy.cfg

global
    log /dev/log        local0
    log /dev/log        local1 notice
    chroot /var/lib/haproxy
    ...

If I understand correctly this will send logs to /dev/log with facility local0 and for level notice and above, send the same logs with facility local1. What is the purpose of this duplication?

Examples of this configuration in the wild:

augurar
  • 277

2 Answers2

2

As you stated, at first sight this configuration does not make a lot of sense.

So that i cannot find any official haproxy documentation that suggests this config.

It looks more like a sample config you have to customize, according to your needs, showing how you can use different facilities/syslog server based on levels.

From doc :

  • Connections are logged at level "info"
  • Level "notice" will be used to indicate a server going up
  • "warning" will be used for termination signals and definitive service termination
  • "alert" will be used for when a server goes down

With the config you provide, the advantage is that you will not miss any logs (local0), but you can, at first, focus on logs that directly involve service or server events using local1 as a filter for your syslog server.

Then, with further looking at local0 logs, you can fine tune your filter for your alert system according to your requirement.

krisFR
  • 13,690
1

/dev/log is local e.g. syslog address. You could send logs to a remove rsyslog server using:

global
    log 10.0.0.1:514 local0

local0 is a "standard" syslog facility, where supported values are kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, auth2, ftp, ntp, audit, alert, cron2, local0, local1, local2, local3, local4, local5, local6, local7

The last (optional) parameter is a severity level, where supported values are:

  1. emerg
  2. alert
  3. crit
  4. err
  5. warning
  6. notice
  7. info
  8. debug

Note that the info level is more verbose than notice (unlike in other logging systems).

Tombart
  • 2,523