HAProxy服务器（带日志）

Tomlou

901人浏览 · 2025-06-12 16:46:22

Tomlou · 2025-06-12 16:46:22 发布

环境：WindowsAD域控 10.10.10.1/10.10.10.2

准入系统 10.10.11.100

HAProxy服务器 10.10.10.200 redhat7.9

1.安装 HAProxy

安装软件及依赖

yum install -y haproxy zlib-devel pcre-devel openssl-devel systemd-devel

验证

[root@xxx ~]# haproxy -v
HA-Proxy version 1.5.18 2016/05/10
Copyright 2000-2016 Willy Tarreau <willy@haproxy.org>

2、关闭 SELinux

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

验证

[root@xxx ~]# getenforce
Permissive

3. 允许系统绑定非本机 IP 地址

内核参数 net.ipv4.ip_nonlocal_bind = 1

允许非本地IP地址socket监听，当主机作为网关、反向代理或负载均衡器实现双机热备高可用时，主机需要绑定监听虚拟VIP地址时，必须开启此项。

cat >> /etc/sysctl.conf << EOF
net.ipv4.ip_nonlocal_bind = 1
EOF

验证

[root@xxx ~]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1

4. 配置HAProxy

备份HAProxy配置文件

mv /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bk

编辑HAProxy配置文件

vi /etc/haproxy/haproxy.cfg

haproxy.cfg内容如下：

global
    log /var/lib/haproxy/dev/log local0 info  # 指定日志输出位置
    maxconn 5000
    user haproxy
    group haproxy
    daemon

defaults
    mode tcp
    log global
    option tcplog
    timeout connect 5s
    timeout client 30s
    timeout server 30s
    retries 3

frontend ldap_frontend
    bind 10.10.10.200:389
    default_backend ldap_backend
    log global

backend ldap_backend
    balance roundrobin
    option tcp-check
    tcp-check connect port 389
    server dc1 10.10.10.1:389 check inter 10s fall 3 rise 2
    server dc2 10.10.10.2:389 check inter 10s fall 3 rise 2

5. 创建日志套接字和目录

创建日志套接字目录

mkdir -p /var/lib/haproxy/dev
touch /var/lib/haproxy/dev/log
chown -R haproxy:haproxy /var/lib/haproxy
chmod 755 /var/lib/haproxy/dev

创建统一日志目录

mkdir -p /var/log/haproxy
chown haproxy:haproxy /var/log/haproxy

6. 配置 Rsyslog

取消/etc/rsyslog.conf中对imuxsock模块的应用，后面也调用了此模块，这里不取消会导致rsyslog运行两个imuxsock模块出现报错

sed -i 's/$ModLoad imuxsock/#$ModLoad imuxsock/' /etc/rsyslog.conf

编辑Rsyslog配置文件

vi /etc/rsyslog.d/haproxy.conf

haproxy.conf内容如下：

# 捕获 HAProxy 日志
$ModLoad imuxsock
$AddUnixListenSocket /var/lib/haproxy/dev/log

# 将所有 HAProxy 日志写入单一文件
:programname, isequal, "haproxy" {
    /var/log/haproxy/haproxy.log
    & stop
}

7. 启用Rsyslog、HAProxy应用

systemctl restart rsyslog
systemctl restart haproxy

8. 验证Rsyslog、HAProxy应用

[root@RJSER-xxx ~]# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2025-06-26 15:19:42 CST; 42min ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 31604 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─31604 /usr/sbin/rsyslogd -n

Jun 26 15:19:42 xxx systemd[1]: Stopped System Logging Service.
Jun 26 15:19:42 xxx systemd[1]: Starting System Logging Service...
Jun 26 15:19:42 xxx rsyslogd[31604]:  [origin software="rsyslogd" swVersion="8.24.0-55.el7" x-pid="31604" x-info="http://www.rsyslog.com"] start
Jun 26 15:19:42 xxx systemd[1]: Started System Logging Service.
[root@xxx ~]# systemctl status haproxy
● haproxy.service - HAProxy Load Balancer
   Loaded: loaded (/usr/lib/systemd/system/haproxy.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-06-26 15:19:56 CST; 42min ago
 Main PID: 31616 (haproxy-systemd)
   CGroup: /system.slice/haproxy.service
           ├─31616 /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
           ├─31617 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds
           └─31618 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds

Jun 26 15:19:56 xxx systemd[1]: Started HAProxy Load Balancer.
Jun 26 15:19:56 xxx haproxy-systemd-wrapper[31616]: haproxy-systemd-wrapper: executing /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds
[root@xxx ~]# tail -f /var/log/haproxy/haproxy.log
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldap_frontend started.
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldap_frontend started.
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldap_backend started.
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldaps_frontend started.
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldaps_frontend started.
Jun 26 15:19:56 xxx haproxy[31617]: Proxy ldaps_backend started.

日志格式说明

在准入系统上配置此服务器IP为LDAP服务器后，在 /var/log/haproxy/haproxy.log 中，您将看到所有 LDAP 流量的详细记录，格式如下：

Jun 12 16:45:22 haproxy-server haproxy[12345]: 10.10.11.100:54321 [12/Jun/2025:16:45:22.123] ldap_frontend ldap_backend/dc1 0/0/1/2/3 200 0 - - ---- 1/1/0/0/0 0/0

各字段含义：