2

I've seen several examples (see below) of HAProxy logging configuration that all look like this:

/etc/haproxy/haproxy.cfg

global
    log /dev/log        local0
    log /dev/log        local1 notice
    chroot /var/lib/haproxy
    ...

If I understand correctly this will send logs to /dev/log with facility local0 and for level notice and above, send the same logs with facility local1. What is the purpose of this duplication?

Examples of this configuration in the wild:

augurar
  • 267
  • 2
  • 12
  • It's because people blindly copied it from other Internet tutorials without understanding what it does. – Michael Hampton Oct 24 '18 at 19:39
  • 1
    @MichaelHampton It also appears in the official HAProxy package for Ubuntu. Surely there's some reason for it? – augurar Oct 24 '18 at 19:40
  • Well, then it probably came from Debian, and in that case it's anyone's guess. It's quite possibly just another one of the very bizarre and occasionally senseless things Debian does. – Michael Hampton Oct 24 '18 at 19:53

1 Answers1

2

As you stated, at first sight this configuration does not make a lot of sense.

So that i cannot find any official haproxy documentation that suggests this config.

It looks more like a sample config you have to customize, according to your needs, showing how you can use different facilities/syslog server based on levels.

From doc :

  • Connections are logged at level "info"
  • Level "notice" will be used to indicate a server going up
  • "warning" will be used for termination signals and definitive service termination
  • "alert" will be used for when a server goes down

With the config you provide, the advantage is that you will not miss any logs (local0), but you can, at first, focus on logs that directly involve service or server events using local1 as a filter for your syslog server.

Then, with further looking at local0 logs, you can fine tune your filter for your alert system according to your requirement.

krisFR
  • 12,830
  • 3
  • 31
  • 40
  • I guess that makes sense although it still seems unnecessary, since you can filter on severity just as easily as on facility. – augurar Oct 25 '18 at 18:38