磅,HAproxy和HAproxy日志

我想弄清楚有关HAproxy日志logging的一件事。 基本上,我们在执行SSL终止的同一台主机上运行HAproxy前面的Pound,然后将请求传递给HAproxy。 我想弄清楚如何将客户端的IPlogging到HAproxy日志。 此刻,无论我做什么,我都得到以下login到HAproxy日志:

Feb 27 19:37:00 localhost.localdomain haproxy[17365]: 127.0.0.1:44880 [27/Feb/2013:19:36:59.786] ssl_application ssl_application/app01 0/0/0/385/386 200 3470 - - ---- 0/0/0/0/0 0/0 "GET / HTTP/1.1" 

我知道127.0.0.1是磅代理请求到HAproxy的IP,但我想知道是否有任何方式如何获得login到HAproxy日志的实际客户端IP。

英镑configuration看起来像这样:

 User "www-data" Group "www-data" LogLevel 3 LogFacility local2 TimeOut 60 # poundctl control socket Control "/var/run/pound/poundctl.socket" ListenHTTPS Address 0.0.0.0 Port 443 Cert "/etc/pound/ssl/certificate.pem" # Allow PUT and DELETE also (by default only GET, POST and HEAD)?: xHTTP 1 Service BackEnd Address 127.0.0.1 Port 8080 End End End 

HA代理configuration如下所示:

 global log 127.0.0.1 local0 info log 127.0.0.1 local1 notice maxconn 4096 user haproxy group haproxy stats socket /var/run/haproxy.sock defaults log global mode http option httplog option dontlognull retries 3 redispatch maxconn 2000 contimeout 5000 clitimeout 50000 srvtimeout 50000 option httpclose option forwardfor # Set up application listeners here. listen application 0.0.0.0:80 acl health_check path_beg /health_check block if health_check option httpchk HEAD /health_check HTTP/1.1\r\nHost:\ staging.example.com balance roundrobin server app01 10.178.64.113:8000 weight 1 maxconn 100 check listen ssl_application 0.0.0.0:8080 acl health_check path_beg /health_check block if health_check option httpchk HEAD /health_check HTTP/1.1\r\nHost:\ staging.example.com balance roundrobin server app01 10.178.64.113:4430 weight 1 maxconn 100 check listen admin 0.0.0.0:22002 mode http stats uri / 

任何build议将不胜感激! 客户端的IP必须隐藏在某处,因为它正在login到HAproxy后面的Nginx。 这只是解决如何将其logging到HAproxy日志中的问题。

CMIIW,我从不使用Pound,但是如果您确定Pound能够传递http头部x-forwarded-for,您只需在HAproxy listen部分添加“捕获请求头部x-forwarded-for len 15”( http:// code.google.com/p/haproxy-docs/wiki/capture_request_header ),并确保“选项httplog”也包括在内。

除了X-Forwarded之外,已经提到过,你也可以用Tproxy使整个事情变得透明:

http://blog.loadbalancer.org/transparent-proxy-of-ssl-traffic-using-pound-to-haproxy-backend-patch-and-howto/

这将需要2个子网,并且很难完成。