9.3. Unix Socket commands
- The stats socket is not enabled by default. In order to enable it, it is
- necessary to add one line in the global section of the haproxy configuration.
- A second line is recommended to set a larger timeout, always appreciated when
- issuing commands by hand :
- global
- stats socket /var/run/haproxy.sock mode 600 level admin
- stats timeout 2m
- It is also possible to add multiple instances of the stats socket by repeating
- the line, and make them listen to a TCP port instead of a UNIX socket. This is
- never done by default because this is dangerous, but can be handy in some
- situations :
- global
- stats socket /var/run/haproxy.sock mode 600 level admin
- stats socket ipv4@192.168.0.1:9999 level admin
- stats timeout 2m
- To access the socket, an external utility such as "socat" is required. Socat is
- a swiss-army knife to connect anything to anything. We use it to connect
- terminals to the socket, or a couple of stdin/stdout pipes to it for scripts.
- The two main syntaxes we'll use are the following :
- # socat /var/run/haproxy.sock stdio
- # socat /var/run/haproxy.sock readline
- The first one is used with scripts. It is possible to send the output of a
- script to haproxy, and pass haproxy's output to another script. That's useful
- for retrieving counters or attack traces for example.
- The second one is only useful for issuing commands by hand. It has the benefit
- that the terminal is handled by the readline library which supports line
- editing and history, which is very convenient when issuing repeated commands
- (eg: watch a counter).
- The socket supports two operation modes :
- - interactive
- - non-interactive
- The non-interactive mode is the default when socat connects to the socket. In
- this mode, a single line may be sent. It is processed as a whole, responses are
- sent back, and the connection closes after the end of the response. This is the
- mode that scripts and monitoring tools use. It is possible to send multiple
- commands in this mode, they need to be delimited by a semi-colon (';'). For
- example :
- # echo "show info;show stat;show table" | socat /var/run/haproxy stdio
- If a command needs to use a semi-colon or a backslash (eg: in a value), it
- must be preceded by a backslash ('\').
- The interactive mode displays a prompt ('>') and waits for commands to be
- entered on the line, then processes them, and displays the prompt again to wait
- for a new command. This mode is entered via the "prompt" command which must be
- sent on the first line in non-interactive mode. The mode is a flip switch, if
- "prompt" is sent in interactive mode, it is disabled and the connection closes
- after processing the last command of the same line.
- For this reason, when debugging by hand, it's quite common to start with the
- "prompt" command :
- # socat /var/run/haproxy readline
- prompt
- > show info
- ...
- >
- Since multiple commands may be issued at once, haproxy uses the empty line as a
- delimiter to mark an end of output for each command, and takes care of ensuring
- that no command can emit an empty line on output. A script can thus easily
- parse the output even when multiple commands were pipelined on a single line.
- Some commands may take an optional payload. To add one to a command, the first
- line needs to end with the "<<\n" pattern. The next lines will be treated as
- the payload and can contain as many lines as needed. To validate a command with
- a payload, it needs to end with an empty line.
- Limitations do exist: the length of the whole buffer passed to the CLI must
- not be greater than tune.bfsize and the pattern "<<" must not be glued to the
- last word of the line.
- When entering a paylod while in interactive mode, the prompt will change from
- "> " to "+ ".
- It is important to understand that when multiple haproxy processes are started
- on the same sockets, any process may pick up the request and will output its
- own stats.
- The list of commands currently supported on the stats socket is provided below.
- If an unknown command is sent, haproxy displays the usage message which reminds
- all supported commands. Some commands support a more complex syntax, generally
- it will explain what part of the command is invalid when this happens.
- Some commands require a higher level of privilege to work. If you do not have
- enough privilege, you will get an error "Permission denied". Please check
- the "level" option of the "bind" keyword lines in the configuration manual
- for more information.
- Add an entry into the map <map> to associate the value <value> to the key
- <key>. This command does not verify if the entry already exists. It is
- mainly used to fill a map after a clear operation. Note that if the reference
- <map> is a file and is shared with a map, this map will contain also a new
- pattern entry. Using the payload syntax it is possible to add multiple
- key/value pairs by entering them on separate lines. On each new line, the
- first word is the key and the rest of the line is considered to be the value
- which can even contains spaces.
Example:
# socat /tmp/sock1 -
prompt
> add map #-1 <<
+ key1 value1
+ key2 value2 with spaces
+ key3 value3 also with spaces
+ key4 value4
>
- Clear the max values of the statistics counters in each proxy (frontend &
- backend) and in each server. The accumulated counters are not affected. The
- internal activity counters reported by "show activity" are also reset. This
- can be used to get clean counters after an incident, without having to
- restart nor to clear traffic counters. This command is restricted and can
- only be issued on sockets configured for levels "operator" or "admin".
- Clear all statistics counters in each proxy (frontend & backend) and in each
- server. This has the same effect as restarting. This command is restricted
- and can only be issued on sockets configured for level "admin".
- Remove all entries from the acl <acl>. <acl> is the #<id> or the <file>
- returned by "show acl". Note that if the reference <acl> is a file and is
- shared with a map, this map will be also cleared.
[ data.
- Remove all entries from the map <map>. <map> is the #<id> or the <file>
- returned by "show map". Note that if the reference <map> is a file and is
- shared with a acl, this acl will be also cleared.
- Remove entries from the stick-table <table>.
- This is typically used to unblock some users complaining they have been
- abusively denied access to a service, but this can also be used to clear some
- stickiness entries matching a server that is going to be replaced (see "show
- table" below for details). Note that sometimes, removal of an entry will be
- refused because it is currently tracked by a session. Retrying a few seconds
- later after the session ends is usual enough.
- In the case where no options arguments are given all entries will be removed.
- When the "data." form is used entries matching a filter applied using the
- stored data (see "stick-table" in section 4.2) are removed. A stored data
- type must be specified in <type>, and this data type must be stored in the
- table otherwise an error is reported. The data is compared according to
- <operator> with the 64-bit integer <value>. Operators are the same as with
- the ACLs :
- - eq : match entries whose data is equal to this value
- - ne : match entries whose data is not equal to this value
- - le : match entries whose data is less than or equal to this value
- - ge : match entries whose data is greater than or equal to this value
- - lt : match entries whose data is less than this value
- - gt : match entries whose data is greater than this value
- When the key form is used the entry <key> is removed. The key must be of the
- same type as the table, which currently is limited to IPv4, IPv6, integer and
- string.
Example :
$ echo "show table http_proxy" | socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:2
>>> 0x80e6a4c: key=127.0.0.1 use=0 exp=3594729 gpc0=0 conn_rate(30000)=1 \
bytes_out_rate(60000)=187
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
$ echo "clear table http_proxy key 127.0.0.1" | socat stdio /tmp/sock1
$ echo "show table http_proxy" | socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:1
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
$ echo "clear table http_proxy data.gpc0 eq 1" | socat stdio /tmp/sock1
$ echo "show table http_proxy" | socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:1
debug dev
- Call a developer-specific command. Only supported when haproxy is built with
- DEBUG_DEV defined. Supported commands are then listed in the help message.
- All of these commands require admin privileges, and must never appear on a
- production system as most of them are unsafe and dangerous.
- Delete all the acl entries from the acl <acl> corresponding to the key <key>.
- <acl> is the #<id> or the <file> returned by "show acl". If the <ref> is used,
- this command delete only the listed reference. The reference can be found with
- listing the content of the acl. Note that if the reference <acl> is a file and
- is shared with a map, the entry will be also deleted in the map.
- Delete all the map entries from the map <map> corresponding to the key <key>.
- <map> is the #<id> or the <file> returned by "show map". If the <ref> is used,
- this command delete only the listed reference. The reference can be found with
- listing the content of the map. Note that if the reference <map> is a file and
- is shared with a acl, the entry will be also deleted in the map.
- Mark the auxiliary agent check as temporarily stopped.
- In the case where an agent check is being run as a auxiliary check, due
- to the agent-check parameter of a server directive, new checks are only
- initialized when the agent is in the enabled. Thus, disable agent will
- prevent any new agent checks from begin initiated until the agent
- re-enabled using enable agent.
- When an agent is disabled the processing of an auxiliary agent check that
- was initiated while the agent was set as enabled is as follows: All
- results that would alter the weight, specifically "drain" or a weight
- returned by the agent, are ignored. The processing of agent check is
- otherwise unchanged.
- The motivation for this feature is to allow the weight changing effects
- of the agent checks to be paused to allow the weight of a server to be
- configured using set weight without being overridden by the agent.
- This command is restricted and can only be issued on sockets configured for
- level "admin".
disable dynamic-cookie backend
- Disable the generation of dynamic cookies for the backend <backend>
- Mark the frontend as temporarily stopped. This corresponds to the mode which
- is used during a soft restart : the frontend releases the port but can be
- enabled again if needed. This should be used with care as some non-Linux OSes
- are unable to enable it back. This is intended to be used in environments
- where stopping a proxy is not even imaginable but a misconfigured proxy must
- be fixed. That way it's possible to release the port and bind it into another
- process to restore operations. The frontend will appear with status "STOP"
- on the stats page.
- The frontend may be specified either by its name or by its numeric ID,
- prefixed with a sharp ('#').
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Mark the primary health check as temporarily stopped. This will disable
- sending of health checks, and the last health check result will be ignored.
- The server will be in unchecked state and considered UP unless an auxiliary
- agent check forces it down.
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Mark the server DOWN for maintenance. In this mode, no more checks will be
- performed on the server until it leaves maintenance.
- If the server is tracked by other servers, those servers will be set to DOWN
- during the maintenance.
- In the statistics page, a server DOWN for maintenance will appear with a
- "MAINT" status, its tracking servers with the "MAINT(via)" one.
- Both the backend and the server may be specified either by their name or by
- their numeric ID, prefixed with a sharp ('#').
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Resume auxiliary agent check that was temporarily stopped.
- See "disable agent" for details of the effect of temporarily starting
- and stopping an auxiliary agent.
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Enable the generation of dynamic cookies for the backend <backend>.
- A secret key must also be provided.
- Resume a frontend which was temporarily stopped. It is possible that some of
- the listening ports won't be able to bind anymore (eg: if another process
- took them since the 'disable frontend' operation). If this happens, an error
- is displayed. Some operating systems might not be able to resume a frontend
- which was disabled.
- The frontend may be specified either by its name or by its numeric ID,
- prefixed with a sharp ('#').
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Resume a primary health check that was temporarily stopped. This will enable
- sending of health checks again. Please see "disable health" for details.
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- If the server was previously marked as DOWN for maintenance, this marks the
- server UP and checks are re-enabled.
- Both the backend and the server may be specified either by their name or by
- their numeric ID, prefixed with a sharp ('#').
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Lookup the value <value> in the map <map> or in the ACL <acl>. <map> or <acl>
- are the #<id> or the <file> returned by "show map" or "show acl". This command
- returns all the matching patterns associated with this map. This is useful for
- debugging maps and ACLs. The output format is composed by one line par
- matching type. Each line is composed by space-delimited series of words.
- The first two words are:
- <match method>: The match method applied. It can be "found", "bool",
- "int", "ip", "bin", "len", "str", "beg", "sub", "dir",
- "dom", "end" or "reg".
- <match result>: The result. Can be "match" or "no-match".
- The following words are returned only if the pattern matches an entry.
- <index type>: "tree" or "list". The internal lookup algorithm.
- <case>: "case-insensitive" or "case-sensitive". The
- interpretation of the case.
- <entry matched>: match="<entry>". Return the matched pattern. It is
- useful with regular expressions.
- The two last word are used to show the returned value and its type. With the
- "acl" case, the pattern doesn't exist.
- return=nothing: No return because there are no "map".
- return="<value>": The value returned in the string format.
- return=cannot-display: The value cannot be converted as string.
- type="<type>": The type of the returned sample.
- Report the current weight and the initial weight of server <server> in
- backend <backend> or an error if either doesn't exist. The initial weight is
- the one that appears in the configuration file. Both are normally equal
- unless the current weight has been changed. Both the backend and the server
- may be specified either by their name or by their numeric ID, prefixed with a
- sharp ('#').
- Print the list of known keywords and their basic usage. The same help screen
- is also displayed for unknown commands.
- Toggle the prompt at the beginning of the line and enter or leave interactive
- mode. In interactive mode, the connection is not closed after a command
- completes. Instead, the prompt will appear again, indicating the user that
- the interpreter is waiting for a new command. The prompt consists in a right
- angle bracket followed by a space "> ". This mode is particularly convenient
- when one wants to periodically check information such as stats or errors.
- It is also a good idea to enter interactive mode before issuing a "help"
- command.
- Close the connection when in interactive mode.
set dynamic-cookie-key backend
- Modify the secret key used to generate the dynamic persistent cookies.
- This will break the existing sessions.
- Modify the value corresponding to each key <key> in a map <map>. <map> is the
- #<id> or <file> returned by "show map". If the <ref> is used in place of
- <key>, only the entry pointed by <ref> is changed. The new value is <value>.
- Dynamically change the specified frontend's maxconn setting. Any positive
- value is allowed including zero, but setting values larger than the global
- maxconn does not make much sense. If the limit is increased and connections
- were pending, they will immediately be accepted. If it is lowered to a value
- below the current number of connections, new connections acceptation will be
- delayed until the threshold is reached. The frontend might be specified by
- either its name or its numeric ID prefixed with a sharp ('#').
- Dynamically change the specified server's maxconn setting. Any positive
- value is allowed including zero, but setting values larger than the global
- maxconn does not make much sense.
- Dynamically change the global maxconn setting within the range defined by the
- initial global maxconn setting. If it is increased and connections were
- pending, they will immediately be accepted. If it is lowered to a value below
- the current number of connections, new connections acceptation will be
- delayed until the threshold is reached. A value of zero restores the initial
- setting.
set profiling { tasks } { auto | on | off }
- Enables or disables CPU profiling for the indicated subsystem. This is
- equivalent to setting or clearing the "profiling" settings in the "global"
- section of the configuration file. Please also see "show profiling".
set rate-limit connections global
- Change the process-wide connection rate limit, which is set by the global
- 'maxconnrate' setting. A value of zero disables the limitation. This limit
- applies to all frontends and the change has an immediate effect. The value
- is passed in number of connections per second.
set rate-limit http-compression global
- Change the maximum input compression rate, which is set by the global
- 'maxcomprate' setting. A value of zero disables the limitation. The value is
- passed in number of kilobytes per second. The value is available in the "show
- info" on the line "CompressBpsRateLim" in bytes.
set rate-limit sessions global
- Change the process-wide session rate limit, which is set by the global
- 'maxsessrate' setting. A value of zero disables the limitation. This limit
- applies to all frontends and the change has an immediate effect. The value
- is passed in number of sessions per second.
set rate-limit ssl-sessions global
- Change the process-wide SSL session rate limit, which is set by the global
- 'maxsslrate' setting. A value of zero disables the limitation. This limit
- applies to all frontends and the change has an immediate effect. The value
- is passed in number of sessions per second sent to the SSL stack. It applies
- before the handshake in order to protect the stack against handshake abuses.
set server
- Replace the current IP address of a server by the one provided.
- Optionally, the port can be changed using the 'port' parameter.
- Note that changing the port also support switching from/to port mapping
- (notation with +X or -Y), only if a port is configured for the health check.
set server
- Force a server's agent to a new state. This can be useful to immediately
- switch a server's state regardless of some slow agent checks for example.
- Note that the change is propagated to tracking servers if any.
set server
- Change addr for servers agent checks. Allows to migrate agent-checks to
- another address at runtime. You can specify both IP and hostname, it will be
- resolved.
set server
- Change agent string sent to agent check target. Allows to update string while
- changing server address to keep those two matching.
set server
- Force a server's health to a new state. This can be useful to immediately
- switch a server's state regardless of some slow health checks for example.
- Note that the change is propagated to tracking servers if any.
set server
- Change the port used for health checking to <port>
set server
- Force a server's administrative state to a new state. This can be useful to
- disable load balancing and/or any traffic to a server. Setting the state to
- "ready" puts the server in normal mode, and the command is the equivalent of
- the "enable server" command. Setting the state to "maint" disables any traffic
- to the server as well as any health checks. This is the equivalent of the
- "disable server" command. Setting the mode to "drain" only removes the server
- from load balancing but still allows it to be checked and to accept new
- persistent connections. Changes are propagated to tracking servers if any.
set server
- Change a server's weight to the value passed in argument. This is the exact
- equivalent of the "set weight" command below.
set server
- Change a server's FQDN to the value passed in argument. This requires the
- internal run-time DNS resolver to be configured and enabled for this server.
set severity-output [ none | number | string ]
- Change the severity output format of the stats socket connected to for the
- duration of the current session.
- This command is used to update an OCSP Response for a certificate (see "crt"
- on "bind" lines). Same controls are performed as during the initial loading of
- the response. The <response> must be passed as a base64 encoded string of the
- DER encoded response from the OCSP server. This command is not supported with
- BoringSSL.
Example:
openssl ocsp -issuer issuer.pem -cert server.pem \
-host ocsp.issuer.com:80 -respout resp.der
echo "set ssl ocsp-response $(base64 -w 10000 resp.der)" | \
socat stdio /var/run/haproxy.stat
using the payload syntax:
echo -e "set ssl ocsp-response <<\n$(base64 resp.der)\n" | \
socat stdio /var/run/haproxy.stat
- Set the next TLS key for the <id> listener to <tlskey>. This key becomes the
- ultimate key, while the penultimate one is used for encryption (others just
- decrypt). The oldest TLS key present is overwritten. <id> is either a numeric
- #<id> or <file> returned by "show tls-keys". <tlskey> is a base64 encoded 48
- or 80 bits TLS ticket key (ex. openssl rand 80 | openssl base64 -A).
- Create or update a stick-table entry in the table. If the key is not present,
- an entry is inserted. See stick-table in section 4.2 to find all possible
- values for <data_type>. The most likely use consists in dynamically entering
- entries for source IP addresses, with a flag in gpc0 to dynamically block an
- IP address or affect its quality of service. It is possible to pass multiple
- data_types in a single call.
- Change the CLI interface timeout for current connection. This can be useful
- during long debugging sessions where the user needs to constantly inspect
- some indicators without being disconnected. The delay is passed in seconds.
set weight
- Change a server's weight to the value passed in argument. If the value ends
- with the '%' sign, then the new weight will be relative to the initially
- configured weight. Absolute weights are permitted between 0 and 256.
- Relative weights must be positive with the resulting absolute weight is
- capped at 256. Servers which are part of a farm running a static
- load-balancing algorithm have stricter limitations because the weight
- cannot change once set. Thus for these servers, the only accepted values
- are 0 and 100% (or 0 and the initial weight). Changes take effect
- immediately, though certain LB algorithms require a certain amount of
- requests to consider changes. A typical usage of this command is to
- disable a server during an update by setting its weight to zero, then to
- enable it again after the update by setting it back to 100%. This command
- is restricted and can only be issued on sockets configured for level
- "admin". Both the backend and the server may be specified either by their
- name or by their numeric ID, prefixed with a sharp ('#').
show acl [
- Dump info about acl converters. Without argument, the list of all available
- acls is returned. If a <acl> is specified, its contents are dumped. <acl> if
- the #<id> or <file>. The dump format is the same than the map even for the
- sample value. The data returned are not a list of available ACL, but are the
- list of all patterns composing any ACL. Many of these patterns can be shared
- with maps.
- Dump the list of backends available in the running process
- Display the CLI level of the current CLI session. The result could be
- 'admin', 'operator' or 'user'. See also the 'operator' and 'user' commands.
Example :
$ socat /tmp/sock1 readline
prompt
> operator
> show cli level
operator
> user
> show cli level
user
> operator
Permission denied
- Decrease the CLI level of the current CLI session to operator. It can't be
- increase. See also "show cli level"
- Decrease the CLI level of the current CLI session to user. It can't be
- increase. See also "show cli level"
- Reports some counters about internal events that will help developers and
- more generally people who know haproxy well enough to narrow down the causes
- of reports of abnormal behaviours. A typical example would be a properly
- running process never sleeping and eating 100% of the CPU. The output fields
- will be made of one line per metric, and per-thread counters on the same
- line. These counters are 32-bit and will wrap during the process' life, which
- is not a problem since calls to this command will typically be performed
- twice. The fields are purposely not documented so that their exact meaning is
- verified in the code where the counters are fed. These values are also reset
- by the "clear counters" command.
- List CLI sockets. The output format is composed of 3 fields separated by
- spaces. The first field is the socket address, it can be a unix socket, a
- ipv4 address:port couple or a ipv6 one. Socket of other types won't be dump.
- The second field describe the level of the socket: 'admin', 'user' or
- 'operator'. The last field list the processes on which the socket is bound,
- separated by commas, it can be numbers or 'all'.
Example :
$ echo 'show cli sockets' | socat stdio /tmp/sock1
# socket lvl processes
/tmp/sock1 admin all
127.0.0.1:9999 user 2,3,4
127.0.0.2:9969 user 2
[::1]:9999 operator 2
- List the configured caches and the objects stored in each cache tree.
- $ echo 'show cache' | socat stdio /tmp/sock1
- 0x7f6ac6c5b03a: foobar (shctx:0x7f6ac6c5b000, available blocks:3918)
- 1 2 3 4
- 1. pointer to the cache structure
- 2. cache name
- 3. pointer to the mmap area (shctx)
- 4. number of blocks available for reuse in the shctx
- 0x7f6ac6c5b4cc hash:286881868 size:39114 (39 blocks), refcount:9, expire:237
- 1 2 3 4 5 6
- 1. pointer to the cache entry
- 2. first 32 bits of the hash
- 3. size of the object in bytes
- 4. number of blocks used for the object
- 5. number of transactions using the entry
- 6. expiration time, can be negative if already expired
show env [
- Dump one or all environment variables known by the process. Without any
- argument, all variables are dumped. With an argument, only the specified
- variable is dumped if it exists. Otherwise "Variable not found" is emitted.
- Variables are dumped in the same format as they are stored or returned by the
- "env" utility, that is, "<name>=<value>". This can be handy when debugging
- certain configuration files making heavy use of environment variables to
- ensure that they contain the expected values. This command is restricted and
- can only be issued on sockets configured for levels "operator" or "admin".
show errors [
- Dump last known request and response errors collected by frontends and
- backends. If <iid> is specified, the limit the dump to errors concerning
- either frontend or backend whose ID is <iid>. Proxy ID "-1" will cause
- all instances to be dumped. If a proxy name is specified instead, its ID
- will be used as the filter. If "request" or "response" is added after the
- proxy name or ID, only request or response errors will be dumped. This
- command is restricted and can only be issued on sockets configured for
- levels "operator" or "admin".
- The errors which may be collected are the last request and response errors
- caused by protocol violations, often due to invalid characters in header
- names. The report precisely indicates what exact character violated the
- protocol. Other important information such as the exact date the error was
- detected, frontend and backend names, the server name (when known), the
- internal session ID and the source address which has initiated the session
- are reported too.
- All characters are returned, and non-printable characters are encoded. The
- most common ones (\t = 9, \n = 10, \r = 13 and \e = 27) are encoded as one
- letter following a backslash. The backslash itself is encoded as '\\' to
- avoid confusion. Other non-printable characters are encoded '\xNN' where
- NN is the two-digits hexadecimal representation of the character's ASCII
- code.
- Lines are prefixed with the position of their first character, starting at 0
- for the beginning of the buffer. At most one input line is printed per line,
- and large lines will be broken into multiple consecutive output lines so that
- the output never goes beyond 79 characters wide. It is easy to detect if a
- line was broken, because it will not end with '\n' and the next line's offset
- will be followed by a '+' sign, indicating it is a continuation of previous
- line.
Example :
$ echo "show errors -1 response" | socat stdio /tmp/sock1
>>> [04/Mar/2009:15:46:56.081] backend http-in (#2) : invalid response
src 127.0.0.1, session #54, frontend fe-eth0 (#1), server s2 (#1)
response length 213 bytes, error at position 23:
00000 HTTP/1.0 200 OK\r\n
00017 header/bizarre:blah\r\n
00038 Location: blah\r\n
00054 Long-line: this is a very long line which should b
00104+ e broken into multiple lines on the output buffer,
00154+ otherwise it would be too large to print in a ter
00204+ minal\r\n
00211 \r\n
In the example above, we see that the backend "http-in" which has internal
ID 2 has blocked an invalid response from its server s2 which has internal
ID 1. The request was on session 54 initiated by source 127.0.0.1 and
received by frontend fe-eth0 whose ID is 1. The total response length was
213 bytes when the error was detected, and the error was at byte 23. This
is the slash ('/') in header name "header/bizarre", which is not a valid
HTTP character for a header name.
show fd [
- Dump the list of either all open file descriptors or just the one number <fd>
- if specified. This is only aimed at developers who need to observe internal
- states in order to debug complex issues such as abnormal CPU usages. One fd
- is reported per lines, and for each of them, its state in the poller using
- upper case letters for enabled flags and lower case for disabled flags, using
- "P" for "polled", "R" for "ready", "A" for "active", the events status using
- "H" for "hangup", "E" for "error", "O" for "output", "P" for "priority" and
- "I" for "input", a few other flags like "N" for "new" (just added into the fd
- cache), "U" for "updated" (received an update in the fd cache), "L" for
- "linger_risk", "C" for "cloned", then the cached entry position, the pointer
- to the internal owner, the pointer to the I/O callback and its name when
- known. When the owner is a connection, the connection flags, and the target
- are reported (frontend, proxy or server). When the owner is a listener, the
- listener's state and its frontend are reported. There is no point in using
- this command without a good knowledge of the internals. It's worth noting
- that the output format may evolve over time so this output must not be parsed
- by tools designed to be durable.
show info [typed|json]
- Dump info about haproxy status on current process. If "typed" is passed as an
- optional argument, field numbers, names and types are emitted as well so that
- external monitoring products can easily retrieve, possibly aggregate, then
- report information found in fields they don't know. Each field is dumped on
- its own line. If "json" is passed as an optional argument then
- information provided by "typed" output is provided in JSON format as a
- list of JSON objects. By default, the format contains only two columns
- delimited by a colon (':'). The left one is the field name and the right
- one is the value. It is very important to note that in typed output
- format, the dump for a single object is contiguous so that there is no
- need for a consumer to store everything at once.
- When using the typed output format, each line is made of 4 columns delimited
- by colons (':'). The first column is a dot-delimited series of 3 elements. The
- first element is the numeric position of the field in the list (starting at
- zero). This position shall not change over time, but holes are to be expected,
- depending on build options or if some fields are deleted in the future. The
- second element is the field name as it appears in the default "show info"
- output. The third element is the relative process number starting at 1.
- The rest of the line starting after the first colon follows the "typed output
- format" described in the section above. In short, the second column (after the
- first ':') indicates the origin, nature and scope of the variable. The third
- column indicates the type of the field, among "s32", "s64", "u32", "u64" and
- "str". Then the fourth column is the value itself, which the consumer knows
- how to parse thanks to column 3 and how to process thanks to column 2.
- Thus the overall line format in typed mode is :
- <field_pos>.<field_name>.<process_num>:<tags>:<type>:<value>
Example :
> show info
Name: HAProxy
Version: 1.7-dev1-de52ea-146
Release_date: 2016/03/11
Nbproc: 1
Process_num: 1
Pid: 28105
Uptime: 0d 0h00m04s
Uptime_sec: 4
Memmax_MB: 0
PoolAlloc_MB: 0
PoolUsed_MB: 0
PoolFailed: 0
(...)
> show info typed
0.Name.1:POS:str:HAProxy
1.Version.1:POS:str:1.7-dev1-de52ea-146
2.Release_date.1:POS:str:2016/03/11
3.Nbproc.1:CGS:u32:1
4.Process_num.1:KGP:u32:1
5.Pid.1:SGP:u32:28105
6.Uptime.1:MDP:str:0d 0h00m08s
7.Uptime_sec.1:MDP:u32:8
8.Memmax_MB.1:CLP:u32:0
9.PoolAlloc_MB.1:MGP:u32:0
10.PoolUsed_MB.1:MGP:u32:0
11.PoolFailed.1:MCP:u32:0
(...)
- In the typed format, the presence of the process ID at the end of the
- first column makes it very easy to visually aggregate outputs from
- multiple processes.
Example :
$ ( echo show info typed | socat /var/run/haproxy.sock1 ; \
echo show info typed | socat /var/run/haproxy.sock2 ) | \
sort -t . -k 1,1n -k 2,2 -k 3,3n
0.Name.1:POS:str:HAProxy
0.Name.2:POS:str:HAProxy
1.Version.1:POS:str:1.7-dev1-868ab3-148
1.Version.2:POS:str:1.7-dev1-868ab3-148
2.Release_date.1:POS:str:2016/03/11
2.Release_date.2:POS:str:2016/03/11
3.Nbproc.1:CGS:u32:2
3.Nbproc.2:CGS:u32:2
4.Process_num.1:KGP:u32:1
4.Process_num.2:KGP:u32:2
5.Pid.1:SGP:u32:30120
5.Pid.2:SGP:u32:30121
6.Uptime.1:MDP:str:0d 0h01m28s
6.Uptime.2:MDP:str:0d 0h01m28s
(...)
- The format of JSON output is described in a schema which may be output
- using "show schema json".
- The JSON output contains no extra whitespace in order to reduce the
- volume of output. For human consumption passing the output through a
- pretty printer may be helpful. Example :
- $ echo "show info json" | socat /var/run/haproxy.sock stdio | \
- python -m json.tool
- The JSON output contains no extra whitespace in order to reduce the
- volume of output. For human consumption passing the output through a
- pretty printer may be helpful. Example :
- $ echo "show info json" | socat /var/run/haproxy.sock stdio | \
- python -m json.tool
show map [
- Dump info about map converters. Without argument, the list of all available
- maps is returned. If a <map> is specified, its contents are dumped. <map> is
- the #<id> or <file>. The first column is a unique identifier. It can be used
- as reference for the operation "del map" and "set map". The second column is
- the pattern and the third column is the sample if available. The data returned
- are not directly a list of available maps, but are the list of all patterns
- composing any map. Many of these patterns can be shared with ACL.
show peers [
- Dump info about the peers configured in "peers" sections. Without argument,
- the list of the peers belonging to all the "peers" sections are listed. If
- <peers section> is specified, only the information about the peers belonging
- to this "peers" section are dumped.
- Here are two examples of outputs where hostA, hostB and hostC peers belong to
- "sharedlb" peers sections. Only hostA and hostB are connected. Only hostA has
- sent data to hostB.
- $ echo "show peers" | socat - /tmp/hostA
- 0x55deb0224320: [15/Apr/2019:11:28:01] id=sharedlb state=0 flags=0x3 \
- resync_timeout=<PAST> task_calls=45122
- 0x55deb022b540: id=hostC(remote) addr=127.0.0.12:10002 status=CONN \
- reconnect=4s confirm=0
- flags=0x0
- 0x55deb022a440: id=hostA(local) addr=127.0.0.10:10000 status=NONE \
- reconnect=<NEVER> confirm=0
- flags=0x0
- 0x55deb0227d70: id=hostB(remote) addr=127.0.0.11:10001 status=ESTA
- reconnect=2s confirm=0
- flags=0x20000200 appctx:0x55deb028fba0 st0=7 st1=0 task_calls=14456 \
- state=EST
- xprt=RAW src=127.0.0.1:37257 addr=127.0.0.10:10000
- remote_table:0x55deb0224a10 id=stkt local_id=1 remote_id=1
- last_local_table:0x55deb0224a10 id=stkt local_id=1 remote_id=1
- shared tables:
- 0x55deb0224a10 local_id=1 remote_id=1 flags=0x0 remote_data=0x65
- last_acked=0 last_pushed=3 last_get=0 teaching_origin=0 update=3
- table:0x55deb022d6a0 id=stkt update=3 localupdate=3 \
- commitupdate=3 syncing=0
- $ echo "show peers" | socat - /tmp/hostB
- 0x55871b5ab320: [15/Apr/2019:11:28:03] id=sharedlb state=0 flags=0x3 \
- resync_timeout=<PAST> task_calls=3
- 0x55871b5b2540: id=hostC(remote) addr=127.0.0.12:10002 status=CONN \
- reconnect=3s confirm=0
- flags=0x0
- 0x55871b5b1440: id=hostB(local) addr=127.0.0.11:10001 status=NONE \
- reconnect=<NEVER> confirm=0
- flags=0x0
- 0x55871b5aed70: id=hostA(remote) addr=127.0.0.10:10000 status=ESTA \
- reconnect=2s confirm=0
- flags=0x20000200 appctx:0x7fa46800ee00 st0=7 st1=0 task_calls=62356 \
- state=EST
- remote_table:0x55871b5ab960 id=stkt local_id=1 remote_id=1
- last_local_table:0x55871b5ab960 id=stkt local_id=1 remote_id=1
- shared tables:
- 0x55871b5ab960 local_id=1 remote_id=1 flags=0x0 remote_data=0x65
- last_acked=3 last_pushed=0 last_get=3 teaching_origin=0 update=0
- table:0x55871b5b46a0 id=stkt update=1 localupdate=0 \
- commitupdate=0 syncing=0
- Dump the status of internal memory pools. This is useful to track memory
- usage when suspecting a memory leak for example. It does exactly the same
- as the SIGQUIT when running in foreground except that it does not flush
- the pools.
- Dumps the current profiling settings, one per line, as well as the command
- needed to change them.
- Dump the state of the servers found in the running configuration. A backend
- name or identifier may be provided to limit the output to this backend only.
- The dump has the following format:
- - first line contains the format version (1 in this specification);
- - second line contains the column headers, prefixed by a sharp ('#');
- - third line and next ones contain data;
- - each line starting by a sharp ('#') is considered as a comment.
- Since multiple versions of the output may co-exist, below is the list of
- fields and their order per file format version :
- 1:
- be_id: Backend unique id.
- be_name: Backend label.
- srv_id: Server unique id (in the backend).
- srv_name: Server label.
- srv_addr: Server IP address.
- srv_op_state: Server operational state (UP/DOWN/...).
- 0 = SRV_ST_STOPPED
- The server is down.
- 1 = SRV_ST_STARTING
- The server is warming up (up but
- throttled).
- 2 = SRV_ST_RUNNING
- The server is fully up.
- 3 = SRV_ST_STOPPING
- The server is up but soft-stopping
- (eg: 404).
- srv_admin_state: Server administrative state (MAINT/DRAIN/...).
- The state is actually a mask of values :
- 0x01 = SRV_ADMF_FMAINT
- The server was explicitly forced into
- maintenance.
- 0x02 = SRV_ADMF_IMAINT
- The server has inherited the maintenance
- status from a tracked server.
- 0x04 = SRV_ADMF_CMAINT
- The server is in maintenance because of
- the configuration.
- 0x08 = SRV_ADMF_FDRAIN
- The server was explicitly forced into
- drain state.
- 0x10 = SRV_ADMF_IDRAIN
- The server has inherited the drain status
- from a tracked server.
- 0x20 = SRV_ADMF_RMAINT
- The server is in maintenance because of an
- IP address resolution failure.
- 0x40 = SRV_ADMF_HMAINT
- The server FQDN was set from stats socket.
- srv_uweight: User visible server's weight.
- srv_iweight: Server's initial weight.
- srv_time_since_last_change: Time since last operational change.
- srv_check_status: Last health check status.
- srv_check_result: Last check result (FAILED/PASSED/...).
- 0 = CHK_RES_UNKNOWN
- Initialized to this by default.
- 1 = CHK_RES_NEUTRAL
- Valid check but no status information.
- 2 = CHK_RES_FAILED
- Check failed.
- 3 = CHK_RES_PASSED
- Check succeeded and server is fully up
- again.
- 4 = CHK_RES_CONDPASS
- Check reports the server doesn't want new
- sessions.
- srv_check_health: Checks rise / fall current counter.
- srv_check_state: State of the check (ENABLED/PAUSED/...).
- The state is actually a mask of values :
- 0x01 = CHK_ST_INPROGRESS
- A check is currently running.
- 0x02 = CHK_ST_CONFIGURED
- This check is configured and may be
- enabled.
- 0x04 = CHK_ST_ENABLED
- This check is currently administratively
- enabled.
- 0x08 = CHK_ST_PAUSED
- Checks are paused because of maintenance
- (health only).
- srv_agent_state: State of the agent check (ENABLED/PAUSED/...).
- This state uses the same mask values as
- "srv_check_state", adding this specific one :
- 0x10 = CHK_ST_AGENT
- Check is an agent check (otherwise it's a
- health check).
- bk_f_forced_id: Flag to know if the backend ID is forced by
- configuration.
- srv_f_forced_id: Flag to know if the server's ID is forced by
- configuration.
- srv_fqdn: Server FQDN.
- srv_port: Server port.
- srvrecord: DNS SRV record associated to this SRV.
- Dump all known sessions. Avoid doing this on slow connections as this can
- be huge. This command is restricted and can only be issued on sockets
- configured for levels "operator" or "admin".
- Display a lot of internal information about the specified session identifier.
- This identifier is the first field at the beginning of the lines in the dumps
- of "show sess" (it corresponds to the session pointer). Those information are
- useless to most users but may be used by haproxy developers to troubleshoot a
- complex bug. The output format is intentionally not documented so that it can
- freely evolve depending on demands. You may find a description of all fields
- returned in src/dumpstats.c
- The special id "all" dumps the states of all sessions, which must be avoided
- as much as possible as it is highly CPU intensive and can take a lot of time.
show stat [{
- Dump statistics using the CSV format; using the extended typed output
- format described in the section above if "typed" is passed after the
- other arguments; or in JSON if "json" is passed after the other arguments
- . By passing <id>, <type> and <sid>, it is possible to dump only selected
- items :
- - <iid> is a proxy ID, -1 to dump everything. Alternatively, a proxy name
- <proxy> may be specified. In this case, this proxy's ID will be used as
- the ID selector.
- - <type> selects the type of dumpable objects : 1 for frontends, 2 for
- backends, 4 for servers, -1 for everything. These values can be ORed,
- for example:
- 1 + 2 = 3 -> frontend + backend.
- 1 + 2 + 4 = 7 -> frontend + backend + server.
- - <sid> is a server ID, -1 to dump everything from the selected proxy.
Example :
$ echo "show info;show stat" | socat stdio unix-connect:/tmp/sock1
>>> Name: HAProxy
Version: 1.4-dev2-49
Release_date: 2009/09/23
Nbproc: 1
Process_num: 1
(...)
# pxname,svname,qcur,qmax,scur,smax,slim,stot,bin,bout,dreq, (...)
stats,FRONTEND,,,0,0,1000,0,0,0,0,0,0,,,,,OPEN,,,,,,,,,1,1,0, (...)
stats,BACKEND,0,0,0,0,1000,0,0,0,0,0,,0,0,0,0,UP,0,0,0,,0,250,(...)
(...)
www1,BACKEND,0,0,0,0,1000,0,0,0,0,0,,0,0,0,0,UP,1,1,0,,0,250, (...)
$
- In this example, two commands have been issued at once. That way it's easy to
- find which process the stats apply to in multi-process mode. This is not
- needed in the typed output format as the process number is reported on each
- line. Notice the empty line after the information output which marks the end
- of the first block. A similar empty line appears at the end of the second
- block (stats) so that the reader knows the output has not been truncated.
- When "typed" is specified, the output format is more suitable to monitoring
- tools because it provides numeric positions and indicates the type of each
- output field. Each value stands on its own line with process number, element
- number, nature, origin and scope. This same format is available via the HTTP
- stats by passing ";typed" after the URI. It is very important to note that in
- typed output format, the dump for a single object is contiguous so that there
- is no need for a consumer to store everything at once.
- When using the typed output format, each line is made of 4 columns delimited
- by colons (':'). The first column is a dot-delimited series of 5 elements. The
- first element is a letter indicating the type of the object being described.
- At the moment the following object types are known : 'F' for a frontend, 'B'
- for a backend, 'L' for a listener, and 'S' for a server. The second element
- The second element is a positive integer representing the unique identifier of
- the proxy the object belongs to. It is equivalent to the "iid" column of the
- CSV output and matches the value in front of the optional "id" directive found
- in the frontend or backend section. The third element is a positive integer
- containing the unique object identifier inside the proxy, and corresponds to
- the "sid" column of the CSV output. ID 0 is reported when dumping a frontend
- or a backend. For a listener or a server, this corresponds to their respective
- ID inside the proxy. The fourth element is the numeric position of the field
- in the list (starting at zero). This position shall not change over time, but
- holes are to be expected, depending on build options or if some fields are
- deleted in the future. The fifth element is the field name as it appears in
- the CSV output. The sixth element is a positive integer and is the relative
- process number starting at 1.
- The rest of the line starting after the first colon follows the "typed output
- format" described in the section above. In short, the second column (after the
- first ':') indicates the origin, nature and scope of the variable. The third
- column indicates the type of the field, among "s32", "s64", "u32", "u64" and
- "str". Then the fourth column is the value itself, which the consumer knows
- how to parse thanks to column 3 and how to process thanks to column 2.
- Thus the overall line format in typed mode is :
- <obj>.<px_id>.<id>.<fpos>.<fname>.<process_num>:<tags>:<type>:<value>
- Here's an example of typed output format :
- $ echo "show stat typed" | socat stdio unix-connect:/tmp/sock1
- F.2.0.0.pxname.1:MGP:str:private-frontend
- F.2.0.1.svname.1:MGP:str:FRONTEND
- F.2.0.8.bin.1:MGP:u64:0
- F.2.0.9.bout.1:MGP:u64:0
- F.2.0.40.hrsp_2xx.1:MGP:u64:0
- L.2.1.0.pxname.1:MGP:str:private-frontend
- L.2.1.1.svname.1:MGP:str:sock-1
- L.2.1.17.status.1:MGP:str:OPEN
- L.2.1.73.addr.1:MGP:str:0.0.0.0:8001
- S.3.13.60.rtime.1:MCP:u32:0
- S.3.13.61.ttime.1:MCP:u32:0
- S.3.13.62.agent_status.1:MGP:str:L4TOUT
- S.3.13.64.agent_duration.1:MGP:u64:2001
- S.3.13.65.check_desc.1:MCP:str:Layer4 timeout
- S.3.13.66.agent_desc.1:MCP:str:Layer4 timeout
- S.3.13.67.check_rise.1:MCP:u32:2
- S.3.13.68.check_fall.1:MCP:u32:3
- S.3.13.69.check_health.1:SGP:u32:0
- S.3.13.70.agent_rise.1:MaP:u32:1
- S.3.13.71.agent_fall.1:SGP:u32:1
- S.3.13.72.agent_health.1:SGP:u32:1
- S.3.13.73.addr.1:MCP:str:1.255.255.255:8888
- S.3.13.75.mode.1:MAP:str:http
- B.3.0.0.pxname.1:MGP:str:private-backend
- B.3.0.1.svname.1:MGP:str:BACKEND
- B.3.0.2.qcur.1:MGP:u32:0
- B.3.0.3.qmax.1:MGP:u32:0
- B.3.0.4.scur.1:MGP:u32:0
- B.3.0.5.smax.1:MGP:u32:0
- B.3.0.6.slim.1:MGP:u32:1000
- B.3.0.55.lastsess.1:MMP:s32:-1
- (...)
- In the typed format, the presence of the process ID at the end of the
- first column makes it very easy to visually aggregate outputs from
- multiple processes, as show in the example below where each line appears
- for each process :
- $ ( echo show stat typed | socat /var/run/haproxy.sock1 - ; \
- echo show stat typed | socat /var/run/haproxy.sock2 - ) | \
- sort -t . -k 1,1 -k 2,2n -k 3,3n -k 4,4n -k 5,5 -k 6,6n
- B.3.0.0.pxname.1:MGP:str:private-backend
- B.3.0.0.pxname.2:MGP:str:private-backend
- B.3.0.1.svname.1:MGP:str:BACKEND
- B.3.0.1.svname.2:MGP:str:BACKEND
- B.3.0.2.qcur.1:MGP:u32:0
- B.3.0.2.qcur.2:MGP:u32:0
- B.3.0.3.qmax.1:MGP:u32:0
- B.3.0.3.qmax.2:MGP:u32:0
- B.3.0.4.scur.1:MGP:u32:0
- B.3.0.4.scur.2:MGP:u32:0
- B.3.0.5.smax.1:MGP:u32:0
- B.3.0.5.smax.2:MGP:u32:0
- B.3.0.6.slim.1:MGP:u32:1000
- B.3.0.6.slim.2:MGP:u32:1000
- (...)
- The format of JSON output is described in a schema which may be output
- using "show schema json".
- The JSON output contains no extra whitespace in order to reduce the
- volume of output. For human consumption passing the output through a
- pretty printer may be helpful. Example :
- $ echo "show stat json" | socat /var/run/haproxy.sock stdio | \
- python -m json.tool
- The JSON output contains no extra whitespace in order to reduce the
- volume of output. For human consumption passing the output through a
- pretty printer may be helpful. Example :
- $ echo "show stat json" | socat /var/run/haproxy.sock stdio | \
- python -m json.tool
- Dump statistics for the given resolvers section, or all resolvers sections
- if no section is supplied.
- For each name server, the following counters are reported:
- sent: number of DNS requests sent to this server
- valid: number of DNS valid responses received from this server
- update: number of DNS responses used to update the server's IP address
- cname: number of CNAME responses
- cname_error: CNAME errors encountered with this server
- any_err: number of empty response (IE: server does not support ANY type)
- nx: non existent domain response received from this server
- timeout: how many time this server did not answer in time
- refused: number of requests refused by this server
- other: any other DNS errors
- invalid: invalid DNS response (from a protocol point of view)
- too_big: too big response
- outdated: number of response arrived too late (after an other name server)
- Dump general information on all known stick-tables. Their name is returned
- (the name of the proxy which holds them), their type (currently zero, always
- IP), their size in maximum possible number of entries, and the number of
- entries currently in use.
Example :
$ echo "show table" | socat stdio /tmp/sock1
>>> # table: front_pub, type: ip, size:204800, used:171454
>>> # table: back_rdp, type: ip, size:204800, used:0
show table
- Dump contents of stick-table <name>. In this mode, a first line of generic
- information about the table is reported as with "show table", then all
- entries are dumped. Since this can be quite heavy, it is possible to specify
- a filter in order to specify what entries to display.
- When the "data." form is used the filter applies to the stored data (see
- "stick-table" in section 4.2). A stored data type must be specified
- in <type>, and this data type must be stored in the table otherwise an
- error is reported. The data is compared according to <operator> with the
- 64-bit integer <value>. Operators are the same as with the ACLs :
- - eq : match entries whose data is equal to this value
- - ne : match entries whose data is not equal to this value
- - le : match entries whose data is less than or equal to this value
- - ge : match entries whose data is greater than or equal to this value
- - lt : match entries whose data is less than this value
- - gt : match entries whose data is greater than this value
- When the key form is used the entry <key> is shown. The key must be of the
- same type as the table, which currently is limited to IPv4, IPv6, integer,
- and string.
Example :
$ echo "show table http_proxy" | socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:2
>>> 0x80e6a4c: key=127.0.0.1 use=0 exp=3594729 gpc0=0 conn_rate(30000)=1 \
bytes_out_rate(60000)=187
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
$ echo "show table http_proxy data.gpc0 gt 0" | socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:2
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
$ echo "show table http_proxy data.conn_rate gt 5" | \
socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:2
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
$ echo "show table http_proxy key 127.0.0.2" | \
socat stdio /tmp/sock1
>>> # table: http_proxy, type: ip, size:204800, used:2
>>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
bytes_out_rate(60000)=191
- When the data criterion applies to a dynamic value dependent on time such as
- a bytes rate, the value is dynamically computed during the evaluation of the
- entry in order to decide whether it has to be dumped or not. This means that
- such a filter could match for some time then not match anymore because as
- time goes, the average event rate drops.
- It is possible to use this to extract lists of IP addresses abusing the
- service, in order to monitor them or even blacklist them in a firewall.
Example :
$ echo "show table http_proxy data.gpc0 gt 0" \
| socat stdio /tmp/sock1 \
| fgrep 'key=' | cut -d' ' -f2 | cut -d= -f2 > abusers-ip.txt
( or | awk '/key/{ print a[split($2,a,"=")]; }' )
- Dumps some internal states and structures for each thread, that may be useful
- to help developers understand a problem. The output tries to be readable by
- showing one block per thread. When haproxy is built with USE_THREAD_DUMP=1,
- an advanced dump mechanism involving thread signals is used so that each
- thread can dump its own state in turn. Without this option, the thread
- processing the command shows all its details but the other ones are less
- detailed. A star ('*') is displayed in front of the thread handling the
- command. A right angle bracket ('>') may also be displayed in front of
- threads which didn't make any progress since last invocation of this command,
- indicating a bug in the code which must absolutely be reported. When this
- happens between two threads it usually indicates a deadlock. If a thread is
- alone, it's a different bug like a corrupted list. In all cases the process
- needs is not fully functional anymore and needs to be restarted.
- The output format is purposely not documented so that it can easily evolve as
- new needs are identified, without having to maintain any form of backwards
- compatibility, and just like with "show activity", the values are meaningless
- without the code at hand.
show tls-keys [id|*]
- Dump all loaded TLS ticket keys references. The TLS ticket key reference ID
- and the file from which the keys have been loaded is shown. Both of those
- can be used to update the TLS keys using "set ssl tls-key". If an ID is
- specified as parameter, it will dump the tickets, using * it will dump every
- keys from every references.
- Dump the schema used for the output of "show info json" and "show stat json".
- The contains no extra whitespace in order to reduce the volume of output.
- For human consumption passing the output through a pretty printer may be
- helpful. Example :
- $ echo "show schema json" | socat /var/run/haproxy.sock stdio | \
- python -m json.tool
- The schema follows "JSON Schema" (json-schema.org) and accordingly
- verifiers may be used to verify the output of "show info json" and "show
- stat json" against the schema.
- Completely delete the specified frontend. All the ports it was bound to will
- be released. It will not be possible to enable the frontend anymore after
- this operation. This is intended to be used in environments where stopping a
- proxy is not even imaginable but a misconfigured proxy must be fixed. That
- way it's possible to release the port and bind it into another process to
- restore operations. The frontend will not appear at all on the stats page
- once it is terminated.
- The frontend may be specified either by its name or by its numeric ID,
- prefixed with a sharp ('#').
- This command is restricted and can only be issued on sockets configured for
- level "admin".
- Immediately terminate the session matching the specified session identifier.
- This identifier is the first field at the beginning of the lines in the dumps
- of "show sess" (it corresponds to the session pointer). This can be used to
- terminate a long-running session without waiting for a timeout or when an
- endless transfer is ongoing. Such terminated sessions are reported with a 'K'
- flag in the logs.
- Immediately terminate all the sessions attached to the specified server. This
- can be used to terminate long-running sessions after a server is put into
- maintenance mode, for instance. Such terminated sessions are reported with a
- 'K' flag in the logs.