如何通过 unix sock 将 haproxy 信息日志发送到 rsyslog？

Question

Hi i'm trying to config haproxy/rsyslog so that ONLY haproxy info log is sent to ryslog via unix sock.

Here my config:

haproxy config

frontend MY_FRONT_END
    log 127.0.0.1 /var/log/haproxy/dev/log info
    bind *:12080
    default_backend HTTP_BACKEND

rsyslog config

$ModLoad imuxsock
$InputUnixListenSocketCreatePath on
$InputUnixListenSocketHostName localhost
$AddUnixListenSocket /var/log/haproxy/dev/log
*.info /var/log/haproxy/access.log

However, what i see in the log is not just haproxy log, the log contain all the info that not relate to haproxy (the first three log lines)

Dec 28 20:28:12 localhost sudo:   testaccount : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/sh -c ip addr show
Dec 28 20:28:12 localhost sudo:   testaccount : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/sh -c ip route
Dec 28 20:28:13 localhost sudo:   testaccount : TTY=pts/1 ; PWD=/var/log/haproxy ; USER=root ; COMMAND=/sbin/service haproxy restart
Dec 28 20:28:13 localhost polkitd[59350]: Registered Authentication Agent for unix-process:32995:43061437 (system bus name :1.28346 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_CA.UTF-8)
Dec 28 20:28:13 localhost systemd: Stopping HAProxy Load Balancer...
Dec 28 20:28:13 localhost haproxy: [WARNING] 362/202813 (30706) : Exiting Master process...
Dec 28 20:28:13 localhost haproxy: [NOTICE] 362/202813 (30706) : haproxy version is 2.2.6
Dec 28 20:28:13 localhost haproxy: [NOTICE] 362/202813 (30706) : path to executable is /usr/local/sbin/haproxy
Dec 28 20:28:13 localhost haproxy: [ALERT] 362/202813 (30706) : Current worker #1 (30708) exited with code 143 (Terminated)
Dec 28 20:28:13 localhost haproxy: [WARNING] 362/202813 (30706) : All workers exited. Exiting... (0)
Dec 28 20:28:13 localhost systemd: Starting HAProxy Load Balancer...
Dec 28 20:28:13 localhost haproxy[33016]: Proxy MY_FRONT_END started.
Dec 28 20:28:13 localhost haproxy[33016]: Proxy HTTP_BACKEND started.
Dec 28 20:28:13 localhost haproxy: [NOTICE] 362/202813 (33016) : New worker #1 (33018) forked
Dec 28 20:28:13 localhost systemd: Started HAProxy Load Balancer.
Dec 28 20:28:13 localhost polkitd[59350]: Unregistered Authentication Agent for unix-process:32995:43061437 (system bus name :1.28346, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_CA.UTF-8) (disconnected from bus)
Dec 28 20:28:13 localhost sudo:   testaccount : TTY=pts/1 ; PWD=/var/log/haproxy ; USER=root ; COMMAND=/sbin/service rsyslog restart

How do i config to achieve this (only send haproxy info log to rsyslog through unix sock)?

Answer 1

The correct answer is probably to use a ruleset to embrace just the imuxsock part, but I don't know how to do that in legacy syntax.

A simpler solution that is less optimal is to check for the programname in the log item. To also match for severity levels 0 to 6 (emerg to info) gives the result:

if $programname=="haproxy" and $syslogseverity<=6 then /var/log/haproxy/access.log

I'm not sure, but you could alternatively try just moving your configuration earlier in the file, before the standard logging code, but then your haproxy logs would appear in the standard logs too unless you use something like

*.info /var/log/haproxy/access.log
*.* stop

where stop stops further processing of that input.