9.3. Unix Socket commands

  1. The stats socket is not enabled by default. In order to enable it, it is
  2. necessary to add one line in the global section of the haproxy configuration.
  3. A second line is recommended to set a larger timeout, always appreciated when
  4. issuing commands by hand :
  5.  
  6. global
  7. stats socket /var/run/haproxy.sock mode 600 level admin
  8. stats timeout 2m
  9.  
  10. It is also possible to add multiple instances of the stats socket by repeating
  11. the line, and make them listen to a TCP port instead of a UNIX socket. This is
  12. never done by default because this is dangerous, but can be handy in some
  13. situations :
  14.  
  15. global
  16. stats socket /var/run/haproxy.sock mode 600 level admin
  17. stats socket ipv4@192.168.0.1:9999 level admin
  18. stats timeout 2m
  19.  
  20. To access the socket, an external utility such as "socat" is required. Socat is
  21. a swiss-army knife to connect anything to anything. We use it to connect
  22. terminals to the socket, or a couple of stdin/stdout pipes to it for scripts.
  23. The two main syntaxes we'll use are the following :
  24.  
  25. # socat /var/run/haproxy.sock stdio
  26. # socat /var/run/haproxy.sock readline
  27.  
  28. The first one is used with scripts. It is possible to send the output of a
  29. script to haproxy, and pass haproxy's output to another script. That's useful
  30. for retrieving counters or attack traces for example.
  31.  
  32. The second one is only useful for issuing commands by hand. It has the benefit
  33. that the terminal is handled by the readline library which supports line
  34. editing and history, which is very convenient when issuing repeated commands
  35. (eg: watch a counter).
  36.  
  37. The socket supports two operation modes :
  38. - interactive
  39. - non-interactive
  40.  
  41. The non-interactive mode is the default when socat connects to the socket. In
  42. this mode, a single line may be sent. It is processed as a whole, responses are
  43. sent back, and the connection closes after the end of the response. This is the
  44. mode that scripts and monitoring tools use. It is possible to send multiple
  45. commands in this mode, they need to be delimited by a semi-colon (';'). For
  46. example :
  47.  
  48. # echo "show info;show stat;show table" | socat /var/run/haproxy stdio
  49.  
  50. If a command needs to use a semi-colon or a backslash (eg: in a value), it
  51. must be preceded by a backslash ('\').
  52.  
  53. The interactive mode displays a prompt ('>') and waits for commands to be
  54. entered on the line, then processes them, and displays the prompt again to wait
  55. for a new command. This mode is entered via the "prompt" command which must be
  56. sent on the first line in non-interactive mode. The mode is a flip switch, if
  57. "prompt" is sent in interactive mode, it is disabled and the connection closes
  58. after processing the last command of the same line.
  59.  
  60. For this reason, when debugging by hand, it's quite common to start with the
  61. "prompt" command :
  62.  
  63. # socat /var/run/haproxy readline
  64. prompt
  65. > show info
  66. ...
  67. >
  68.  
  69. Since multiple commands may be issued at once, haproxy uses the empty line as a
  70. delimiter to mark an end of output for each command, and takes care of ensuring
  71. that no command can emit an empty line on output. A script can thus easily
  72. parse the output even when multiple commands were pipelined on a single line.
  73.  
  74. Some commands may take an optional payload. To add one to a command, the first
  75. line needs to end with the "<<\n" pattern. The next lines will be treated as
  76. the payload and can contain as many lines as needed. To validate a command with
  77. a payload, it needs to end with an empty line.
  78.  
  79. Limitations do exist: the length of the whole buffer passed to the CLI must
  80. not be greater than tune.bfsize and the pattern "<<" must not be glued to the
  81. last word of the line.
  82.  
  83. When entering a paylod while in interactive mode, the prompt will change from
  84. "> " to "+ ".
  85.  
  86. It is important to understand that when multiple haproxy processes are started
  87. on the same sockets, any process may pick up the request and will output its
  88. own stats.
  89.  
  90. The list of commands currently supported on the stats socket is provided below.
  91. If an unknown command is sent, haproxy displays the usage message which reminds
  92. all supported commands. Some commands support a more complex syntax, generally
  93. it will explain what part of the command is invalid when this happens.
  94.  
  95. Some commands require a higher level of privilege to work. If you do not have
  96. enough privilege, you will get an error "Permission denied". Please check
  97. the "level" option of the "bind" keyword lines in the configuration manual
  98. for more information.

add acl

  1. Add an entry into the acl <acl>. <acl> is the #<id> or the <file> returned by
  2. "show acl". This command does not verify if the entry already exists. This
  3. command cannot be used if the reference <acl> is a file also used with a map.
  4. In this case, you must use the command "add map" in place of "add acl".

add map

add map

  1. Add an entry into the map <map> to associate the value <value> to the key
  2. <key>. This command does not verify if the entry already exists. It is
  3. mainly used to fill a map after a clear operation. Note that if the reference
  4. <map> is a file and is shared with a map, this map will contain also a new
  5. pattern entry. Using the payload syntax it is possible to add multiple
  6. key/value pairs by entering them on separate lines. On each new line, the
  7. first word is the key and the rest of the line is considered to be the value
  8. which can even contains spaces.

Example:

  1. # socat /tmp/sock1 -
  2. prompt
  3. > add map #-1 <<
  4. + key1 value1
  5. + key2 value2 with spaces
  6. + key3 value3 also with spaces
  7. + key4 value4
  8. >

clear counters

  1. Clear the max values of the statistics counters in each proxy (frontend &
  2. backend) and in each server. The accumulated counters are not affected. The
  3. internal activity counters reported by "show activity" are also reset. This
  4. can be used to get clean counters after an incident, without having to
  5. restart nor to clear traffic counters. This command is restricted and can
  6. only be issued on sockets configured for levels "operator" or "admin".

clear counters all

  1. Clear all statistics counters in each proxy (frontend & backend) and in each
  2. server. This has the same effect as restarting. This command is restricted
  3. and can only be issued on sockets configured for level "admin".

clear acl

  1. Remove all entries from the acl <acl>. <acl> is the #<id> or the <file>
  2. returned by "show acl". Note that if the reference <acl> is a file and is
  3. shared with a map, this map will be also cleared.

clear map

  1. Remove all entries from the map <map>. <map> is the #<id> or the <file>
  2. returned by "show map". Note that if the reference <map> is a file and is
  3. shared with a acl, this acl will be also cleared.

clear table

[ data. ] | [ key ]

  1. Remove entries from the stick-table <table>.
  2.  
  3. This is typically used to unblock some users complaining they have been
  4. abusively denied access to a service, but this can also be used to clear some
  5. stickiness entries matching a server that is going to be replaced (see "show
  6. table" below for details). Note that sometimes, removal of an entry will be
  7. refused because it is currently tracked by a session. Retrying a few seconds
  8. later after the session ends is usual enough.
  9.  
  10. In the case where no options arguments are given all entries will be removed.
  11.  
  12. When the "data." form is used entries matching a filter applied using the
  13. stored data (see "stick-table" in section 4.2) are removed. A stored data
  14. type must be specified in <type>, and this data type must be stored in the
  15. table otherwise an error is reported. The data is compared according to
  16. <operator> with the 64-bit integer <value>. Operators are the same as with
  17. the ACLs :
  18.  
  19. - eq : match entries whose data is equal to this value
  20. - ne : match entries whose data is not equal to this value
  21. - le : match entries whose data is less than or equal to this value
  22. - ge : match entries whose data is greater than or equal to this value
  23. - lt : match entries whose data is less than this value
  24. - gt : match entries whose data is greater than this value
  25.  
  26. When the key form is used the entry <key> is removed. The key must be of the
  27. same type as the table, which currently is limited to IPv4, IPv6, integer and
  28. string.

Example :

  1. $ echo "show table http_proxy" | socat stdio /tmp/sock1
  2. >>> # table: http_proxy, type: ip, size:204800, used:2
  3. >>> 0x80e6a4c: key=127.0.0.1 use=0 exp=3594729 gpc0=0 conn_rate(30000)=1 \
  4. bytes_out_rate(60000)=187
  5. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  6. bytes_out_rate(60000)=191
  7. $ echo "clear table http_proxy key 127.0.0.1" | socat stdio /tmp/sock1
  8. $ echo "show table http_proxy" | socat stdio /tmp/sock1
  9. >>> # table: http_proxy, type: ip, size:204800, used:1
  10. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  11. bytes_out_rate(60000)=191
  12. $ echo "clear table http_proxy data.gpc0 eq 1" | socat stdio /tmp/sock1
  13. $ echo "show table http_proxy" | socat stdio /tmp/sock1
  14. >>> # table: http_proxy, type: ip, size:204800, used:1

debug dev [args]*

  1. Call a developer-specific command. Only supported when haproxy is built with
  2. DEBUG_DEV defined. Supported commands are then listed in the help message.
  3. All of these commands require admin privileges, and must never appear on a
  4. production system as most of them are unsafe and dangerous.

del acl [|#]

  1. Delete all the acl entries from the acl <acl> corresponding to the key <key>.
  2. <acl> is the #<id> or the <file> returned by "show acl". If the <ref> is used,
  3. this command delete only the listed reference. The reference can be found with
  4. listing the content of the acl. Note that if the reference <acl> is a file and
  5. is shared with a map, the entry will be also deleted in the map.

del map [|#]

  1. Delete all the map entries from the map <map> corresponding to the key <key>.
  2. <map> is the #<id> or the <file> returned by "show map". If the <ref> is used,
  3. this command delete only the listed reference. The reference can be found with
  4. listing the content of the map. Note that if the reference <map> is a file and
  5. is shared with a acl, the entry will be also deleted in the map.

disable agent /

  1. Mark the auxiliary agent check as temporarily stopped.
  2.  
  3. In the case where an agent check is being run as a auxiliary check, due
  4. to the agent-check parameter of a server directive, new checks are only
  5. initialized when the agent is in the enabled. Thus, disable agent will
  6. prevent any new agent checks from begin initiated until the agent
  7. re-enabled using enable agent.
  8.  
  9. When an agent is disabled the processing of an auxiliary agent check that
  10. was initiated while the agent was set as enabled is as follows: All
  11. results that would alter the weight, specifically "drain" or a weight
  12. returned by the agent, are ignored. The processing of agent check is
  13. otherwise unchanged.
  14.  
  15. The motivation for this feature is to allow the weight changing effects
  16. of the agent checks to be paused to allow the weight of a server to be
  17. configured using set weight without being overridden by the agent.
  18.  
  19. This command is restricted and can only be issued on sockets configured for
  20. level "admin".

disable dynamic-cookie backend

  1. Disable the generation of dynamic cookies for the backend <backend>

disable frontend

  1. Mark the frontend as temporarily stopped. This corresponds to the mode which
  2. is used during a soft restart : the frontend releases the port but can be
  3. enabled again if needed. This should be used with care as some non-Linux OSes
  4. are unable to enable it back. This is intended to be used in environments
  5. where stopping a proxy is not even imaginable but a misconfigured proxy must
  6. be fixed. That way it's possible to release the port and bind it into another
  7. process to restore operations. The frontend will appear with status "STOP"
  8. on the stats page.
  9.  
  10. The frontend may be specified either by its name or by its numeric ID,
  11. prefixed with a sharp ('#').
  12.  
  13. This command is restricted and can only be issued on sockets configured for
  14. level "admin".

disable health /

  1. Mark the primary health check as temporarily stopped. This will disable
  2. sending of health checks, and the last health check result will be ignored.
  3. The server will be in unchecked state and considered UP unless an auxiliary
  4. agent check forces it down.
  5.  
  6. This command is restricted and can only be issued on sockets configured for
  7. level "admin".

disable server /

  1. Mark the server DOWN for maintenance. In this mode, no more checks will be
  2. performed on the server until it leaves maintenance.
  3. If the server is tracked by other servers, those servers will be set to DOWN
  4. during the maintenance.
  5.  
  6. In the statistics page, a server DOWN for maintenance will appear with a
  7. "MAINT" status, its tracking servers with the "MAINT(via)" one.
  8.  
  9. Both the backend and the server may be specified either by their name or by
  10. their numeric ID, prefixed with a sharp ('#').
  11.  
  12. This command is restricted and can only be issued on sockets configured for
  13. level "admin".

enable agent /

  1. Resume auxiliary agent check that was temporarily stopped.
  2.  
  3. See "disable agent" for details of the effect of temporarily starting
  4. and stopping an auxiliary agent.
  5.  
  6. This command is restricted and can only be issued on sockets configured for
  7. level "admin".

enable dynamic-cookie backend

  1. Enable the generation of dynamic cookies for the backend <backend>.
  2. A secret key must also be provided.

enable frontend

  1. Resume a frontend which was temporarily stopped. It is possible that some of
  2. the listening ports won't be able to bind anymore (eg: if another process
  3. took them since the 'disable frontend' operation). If this happens, an error
  4. is displayed. Some operating systems might not be able to resume a frontend
  5. which was disabled.
  6.  
  7. The frontend may be specified either by its name or by its numeric ID,
  8. prefixed with a sharp ('#').
  9.  
  10. This command is restricted and can only be issued on sockets configured for
  11. level "admin".

enable health /

  1. Resume a primary health check that was temporarily stopped. This will enable
  2. sending of health checks again. Please see "disable health" for details.
  3.  
  4. This command is restricted and can only be issued on sockets configured for
  5. level "admin".

enable server /

  1. If the server was previously marked as DOWN for maintenance, this marks the
  2. server UP and checks are re-enabled.
  3.  
  4. Both the backend and the server may be specified either by their name or by
  5. their numeric ID, prefixed with a sharp ('#').
  6.  
  7. This command is restricted and can only be issued on sockets configured for
  8. level "admin".

get map

get acl

  1. Lookup the value <value> in the map <map> or in the ACL <acl>. <map> or <acl>
  2. are the #<id> or the <file> returned by "show map" or "show acl". This command
  3. returns all the matching patterns associated with this map. This is useful for
  4. debugging maps and ACLs. The output format is composed by one line par
  5. matching type. Each line is composed by space-delimited series of words.
  6.  
  7. The first two words are:
  8.  
  9. <match method>: The match method applied. It can be "found", "bool",
  10. "int", "ip", "bin", "len", "str", "beg", "sub", "dir",
  11. "dom", "end" or "reg".
  12.  
  13. <match result>: The result. Can be "match" or "no-match".
  14.  
  15. The following words are returned only if the pattern matches an entry.
  16.  
  17. <index type>: "tree" or "list". The internal lookup algorithm.
  18.  
  19. <case>: "case-insensitive" or "case-sensitive". The
  20. interpretation of the case.
  21.  
  22. <entry matched>: match="<entry>". Return the matched pattern. It is
  23. useful with regular expressions.
  24.  
  25. The two last word are used to show the returned value and its type. With the
  26. "acl" case, the pattern doesn't exist.
  27.  
  28. return=nothing: No return because there are no "map".
  29. return="<value>": The value returned in the string format.
  30. return=cannot-display: The value cannot be converted as string.
  31.  
  32. type="<type>": The type of the returned sample.

get weight /

  1. Report the current weight and the initial weight of server <server> in
  2. backend <backend> or an error if either doesn't exist. The initial weight is
  3. the one that appears in the configuration file. Both are normally equal
  4. unless the current weight has been changed. Both the backend and the server
  5. may be specified either by their name or by their numeric ID, prefixed with a
  6. sharp ('#').

help

  1. Print the list of known keywords and their basic usage. The same help screen
  2. is also displayed for unknown commands.

prompt

  1. Toggle the prompt at the beginning of the line and enter or leave interactive
  2. mode. In interactive mode, the connection is not closed after a command
  3. completes. Instead, the prompt will appear again, indicating the user that
  4. the interpreter is waiting for a new command. The prompt consists in a right
  5. angle bracket followed by a space "> ". This mode is particularly convenient
  6. when one wants to periodically check information such as stats or errors.
  7. It is also a good idea to enter interactive mode before issuing a "help"
  8. command.

quit

  1. Close the connection when in interactive mode.

set dynamic-cookie-key backend

  1. Modify the secret key used to generate the dynamic persistent cookies.
  2. This will break the existing sessions.

set map [|#]

  1. Modify the value corresponding to each key <key> in a map <map>. <map> is the
  2. #<id> or <file> returned by "show map". If the <ref> is used in place of
  3. <key>, only the entry pointed by <ref> is changed. The new value is <value>.

set maxconn frontend

  1. Dynamically change the specified frontend's maxconn setting. Any positive
  2. value is allowed including zero, but setting values larger than the global
  3. maxconn does not make much sense. If the limit is increased and connections
  4. were pending, they will immediately be accepted. If it is lowered to a value
  5. below the current number of connections, new connections acceptation will be
  6. delayed until the threshold is reached. The frontend might be specified by
  7. either its name or its numeric ID prefixed with a sharp ('#').

set maxconn server

  1. Dynamically change the specified server's maxconn setting. Any positive
  2. value is allowed including zero, but setting values larger than the global
  3. maxconn does not make much sense.

set maxconn global

  1. Dynamically change the global maxconn setting within the range defined by the
  2. initial global maxconn setting. If it is increased and connections were
  3. pending, they will immediately be accepted. If it is lowered to a value below
  4. the current number of connections, new connections acceptation will be
  5. delayed until the threshold is reached. A value of zero restores the initial
  6. setting.

set profiling { tasks } { auto | on | off }

  1. Enables or disables CPU profiling for the indicated subsystem. This is
  2. equivalent to setting or clearing the "profiling" settings in the "global"
  3. section of the configuration file. Please also see "show profiling".

set rate-limit connections global

  1. Change the process-wide connection rate limit, which is set by the global
  2. 'maxconnrate' setting. A value of zero disables the limitation. This limit
  3. applies to all frontends and the change has an immediate effect. The value
  4. is passed in number of connections per second.

set rate-limit http-compression global

  1. Change the maximum input compression rate, which is set by the global
  2. 'maxcomprate' setting. A value of zero disables the limitation. The value is
  3. passed in number of kilobytes per second. The value is available in the "show
  4. info" on the line "CompressBpsRateLim" in bytes.

set rate-limit sessions global

  1. Change the process-wide session rate limit, which is set by the global
  2. 'maxsessrate' setting. A value of zero disables the limitation. This limit
  3. applies to all frontends and the change has an immediate effect. The value
  4. is passed in number of sessions per second.

set rate-limit ssl-sessions global

  1. Change the process-wide SSL session rate limit, which is set by the global
  2. 'maxsslrate' setting. A value of zero disables the limitation. This limit
  3. applies to all frontends and the change has an immediate effect. The value
  4. is passed in number of sessions per second sent to the SSL stack. It applies
  5. before the handshake in order to protect the stack against handshake abuses.

set server / addr [port ]

  1. Replace the current IP address of a server by the one provided.
  2. Optionally, the port can be changed using the 'port' parameter.
  3. Note that changing the port also support switching from/to port mapping
  4. (notation with +X or -Y), only if a port is configured for the health check.

set server / agent [ up | down ]

  1. Force a server's agent to a new state. This can be useful to immediately
  2. switch a server's state regardless of some slow agent checks for example.
  3. Note that the change is propagated to tracking servers if any.

set server / agent-addr

  1. Change addr for servers agent checks. Allows to migrate agent-checks to
  2. another address at runtime. You can specify both IP and hostname, it will be
  3. resolved.

set server / agent-send

  1. Change agent string sent to agent check target. Allows to update string while
  2. changing server address to keep those two matching.

set server / health [ up | stopping | down ]

  1. Force a server's health to a new state. This can be useful to immediately
  2. switch a server's state regardless of some slow health checks for example.
  3. Note that the change is propagated to tracking servers if any.

set server / check-port

  1. Change the port used for health checking to <port>

set server / state [ ready | drain | maint ]

  1. Force a server's administrative state to a new state. This can be useful to
  2. disable load balancing and/or any traffic to a server. Setting the state to
  3. "ready" puts the server in normal mode, and the command is the equivalent of
  4. the "enable server" command. Setting the state to "maint" disables any traffic
  5. to the server as well as any health checks. This is the equivalent of the
  6. "disable server" command. Setting the mode to "drain" only removes the server
  7. from load balancing but still allows it to be checked and to accept new
  8. persistent connections. Changes are propagated to tracking servers if any.

set server / weight [%]

  1. Change a server's weight to the value passed in argument. This is the exact
  2. equivalent of the "set weight" command below.

set server / fqdn

  1. Change a server's FQDN to the value passed in argument. This requires the
  2. internal run-time DNS resolver to be configured and enabled for this server.

set severity-output [ none | number | string ]

  1. Change the severity output format of the stats socket connected to for the
  2. duration of the current session.

set ssl ocsp-response

  1. This command is used to update an OCSP Response for a certificate (see "crt"
  2. on "bind" lines). Same controls are performed as during the initial loading of
  3. the response. The <response> must be passed as a base64 encoded string of the
  4. DER encoded response from the OCSP server. This command is not supported with
  5. BoringSSL.

Example:

  1. openssl ocsp -issuer issuer.pem -cert server.pem \
  2. -host ocsp.issuer.com:80 -respout resp.der
  3. echo "set ssl ocsp-response $(base64 -w 10000 resp.der)" | \
  4. socat stdio /var/run/haproxy.stat
  5. using the payload syntax:
  6. echo -e "set ssl ocsp-response <<\n$(base64 resp.der)\n" | \
  7. socat stdio /var/run/haproxy.stat

set ssl tls-key

  1. Set the next TLS key for the <id> listener to <tlskey>. This key becomes the
  2. ultimate key, while the penultimate one is used for encryption (others just
  3. decrypt). The oldest TLS key present is overwritten. <id> is either a numeric
  4. #<id> or <file> returned by "show tls-keys". <tlskey> is a base64 encoded 48
  5. or 80 bits TLS ticket key (ex. openssl rand 80 | openssl base64 -A).

set table

key [data. ]*

  1. Create or update a stick-table entry in the table. If the key is not present,
  2. an entry is inserted. See stick-table in section 4.2 to find all possible
  3. values for <data_type>. The most likely use consists in dynamically entering
  4. entries for source IP addresses, with a flag in gpc0 to dynamically block an
  5. IP address or affect its quality of service. It is possible to pass multiple
  6. data_types in a single call.

set timeout cli

  1. Change the CLI interface timeout for current connection. This can be useful
  2. during long debugging sessions where the user needs to constantly inspect
  3. some indicators without being disconnected. The delay is passed in seconds.

set weight / [%]

  1. Change a server's weight to the value passed in argument. If the value ends
  2. with the '%' sign, then the new weight will be relative to the initially
  3. configured weight. Absolute weights are permitted between 0 and 256.
  4. Relative weights must be positive with the resulting absolute weight is
  5. capped at 256. Servers which are part of a farm running a static
  6. load-balancing algorithm have stricter limitations because the weight
  7. cannot change once set. Thus for these servers, the only accepted values
  8. are 0 and 100% (or 0 and the initial weight). Changes take effect
  9. immediately, though certain LB algorithms require a certain amount of
  10. requests to consider changes. A typical usage of this command is to
  11. disable a server during an update by setting its weight to zero, then to
  12. enable it again after the update by setting it back to 100%. This command
  13. is restricted and can only be issued on sockets configured for level
  14. "admin". Both the backend and the server may be specified either by their
  15. name or by their numeric ID, prefixed with a sharp ('#').

show acl []

  1. Dump info about acl converters. Without argument, the list of all available
  2. acls is returned. If a <acl> is specified, its contents are dumped. <acl> if
  3. the #<id> or <file>. The dump format is the same than the map even for the
  4. sample value. The data returned are not a list of available ACL, but are the
  5. list of all patterns composing any ACL. Many of these patterns can be shared
  6. with maps.

show backend

  1. Dump the list of backends available in the running process

show cli level

  1. Display the CLI level of the current CLI session. The result could be
  2. 'admin', 'operator' or 'user'. See also the 'operator' and 'user' commands.

Example :

  1. $ socat /tmp/sock1 readline
  2. prompt
  3. > operator
  4. > show cli level
  5. operator
  6. > user
  7. > show cli level
  8. user
  9. > operator
  10. Permission denied

operator

  1. Decrease the CLI level of the current CLI session to operator. It can't be
  2. increase. See also "show cli level"

user

  1. Decrease the CLI level of the current CLI session to user. It can't be
  2. increase. See also "show cli level"

show activity

  1. Reports some counters about internal events that will help developers and
  2. more generally people who know haproxy well enough to narrow down the causes
  3. of reports of abnormal behaviours. A typical example would be a properly
  4. running process never sleeping and eating 100% of the CPU. The output fields
  5. will be made of one line per metric, and per-thread counters on the same
  6. line. These counters are 32-bit and will wrap during the process' life, which
  7. is not a problem since calls to this command will typically be performed
  8. twice. The fields are purposely not documented so that their exact meaning is
  9. verified in the code where the counters are fed. These values are also reset
  10. by the "clear counters" command.

show cli sockets

  1. List CLI sockets. The output format is composed of 3 fields separated by
  2. spaces. The first field is the socket address, it can be a unix socket, a
  3. ipv4 address:port couple or a ipv6 one. Socket of other types won't be dump.
  4. The second field describe the level of the socket: 'admin', 'user' or
  5. 'operator'. The last field list the processes on which the socket is bound,
  6. separated by commas, it can be numbers or 'all'.

Example :

  1. $ echo &#x27;show cli sockets' | socat stdio /tmp/sock1
  2. # socket lvl processes
  3. /tmp/sock1 admin all
  4. 127.0.0.1:9999 user 2,3,4
  5. 127.0.0.2:9969 user 2
  6. [::1]:9999 operator 2

show cache

  1. List the configured caches and the objects stored in each cache tree.
  2.  
  3. $ echo 'show cache' | socat stdio /tmp/sock1
  4. 0x7f6ac6c5b03a: foobar (shctx:0x7f6ac6c5b000, available blocks:3918)
  5. 1 2 3 4
  6.  
  7. 1. pointer to the cache structure
  8. 2. cache name
  9. 3. pointer to the mmap area (shctx)
  10. 4. number of blocks available for reuse in the shctx
  11.  
  12. 0x7f6ac6c5b4cc hash:286881868 size:39114 (39 blocks), refcount:9, expire:237
  13. 1 2 3 4 5 6
  14.  
  15. 1. pointer to the cache entry
  16. 2. first 32 bits of the hash
  17. 3. size of the object in bytes
  18. 4. number of blocks used for the object
  19. 5. number of transactions using the entry
  20. 6. expiration time, can be negative if already expired

show env []

  1. Dump one or all environment variables known by the process. Without any
  2. argument, all variables are dumped. With an argument, only the specified
  3. variable is dumped if it exists. Otherwise "Variable not found" is emitted.
  4. Variables are dumped in the same format as they are stored or returned by the
  5. "env" utility, that is, "<name>=<value>". This can be handy when debugging
  6. certain configuration files making heavy use of environment variables to
  7. ensure that they contain the expected values. This command is restricted and
  8. can only be issued on sockets configured for levels "operator" or "admin".

show errors [|] [request|response]

  1. Dump last known request and response errors collected by frontends and
  2. backends. If <iid> is specified, the limit the dump to errors concerning
  3. either frontend or backend whose ID is <iid>. Proxy ID "-1" will cause
  4. all instances to be dumped. If a proxy name is specified instead, its ID
  5. will be used as the filter. If "request" or "response" is added after the
  6. proxy name or ID, only request or response errors will be dumped. This
  7. command is restricted and can only be issued on sockets configured for
  8. levels "operator" or "admin".
  9.  
  10. The errors which may be collected are the last request and response errors
  11. caused by protocol violations, often due to invalid characters in header
  12. names. The report precisely indicates what exact character violated the
  13. protocol. Other important information such as the exact date the error was
  14. detected, frontend and backend names, the server name (when known), the
  15. internal session ID and the source address which has initiated the session
  16. are reported too.
  17.  
  18. All characters are returned, and non-printable characters are encoded. The
  19. most common ones (\t = 9, \n = 10, \r = 13 and \e = 27) are encoded as one
  20. letter following a backslash. The backslash itself is encoded as '\\' to
  21. avoid confusion. Other non-printable characters are encoded '\xNN' where
  22. NN is the two-digits hexadecimal representation of the character's ASCII
  23. code.
  24.  
  25. Lines are prefixed with the position of their first character, starting at 0
  26. for the beginning of the buffer. At most one input line is printed per line,
  27. and large lines will be broken into multiple consecutive output lines so that
  28. the output never goes beyond 79 characters wide. It is easy to detect if a
  29. line was broken, because it will not end with '\n' and the next line's offset
  30. will be followed by a '+' sign, indicating it is a continuation of previous
  31. line.

Example :

  1. $ echo "show errors -1 response" | socat stdio /tmp/sock1
  2. >>> [04/Mar/2009:15:46:56.081] backend http-in (#2) : invalid response
  3. src 127.0.0.1, session #54, frontend fe-eth0 (#1), server s2 (#1)
  4. response length 213 bytes, error at position 23:
  5. 00000 HTTP/1.0 200 OK\r\n
  6. 00017 header/bizarre:blah\r\n
  7. 00038 Location: blah\r\n
  8. 00054 Long-line: this is a very long line which should b
  9. 00104+ e broken into multiple lines on the output buffer,
  10. 00154+ otherwise it would be too large to print in a ter
  11. 00204+ minal\r\n
  12. 00211 \r\n
  13. In the example above, we see that the backend "http-in" which has internal
  14. ID 2 has blocked an invalid response from its server s2 which has internal
  15. ID 1. The request was on session 54 initiated by source 127.0.0.1 and
  16. received by frontend fe-eth0 whose ID is 1. The total response length was
  17. 213 bytes when the error was detected, and the error was at byte 23. This
  18. is the slash (&#x27;/') in header name "header/bizarre", which is not a valid
  19. HTTP character for a header name.

show fd []

  1. Dump the list of either all open file descriptors or just the one number <fd>
  2. if specified. This is only aimed at developers who need to observe internal
  3. states in order to debug complex issues such as abnormal CPU usages. One fd
  4. is reported per lines, and for each of them, its state in the poller using
  5. upper case letters for enabled flags and lower case for disabled flags, using
  6. "P" for "polled", "R" for "ready", "A" for "active", the events status using
  7. "H" for "hangup", "E" for "error", "O" for "output", "P" for "priority" and
  8. "I" for "input", a few other flags like "N" for "new" (just added into the fd
  9. cache), "U" for "updated" (received an update in the fd cache), "L" for
  10. "linger_risk", "C" for "cloned", then the cached entry position, the pointer
  11. to the internal owner, the pointer to the I/O callback and its name when
  12. known. When the owner is a connection, the connection flags, and the target
  13. are reported (frontend, proxy or server). When the owner is a listener, the
  14. listener's state and its frontend are reported. There is no point in using
  15. this command without a good knowledge of the internals. It's worth noting
  16. that the output format may evolve over time so this output must not be parsed
  17. by tools designed to be durable.

show info [typed|json]

  1. Dump info about haproxy status on current process. If "typed" is passed as an
  2. optional argument, field numbers, names and types are emitted as well so that
  3. external monitoring products can easily retrieve, possibly aggregate, then
  4. report information found in fields they don't know. Each field is dumped on
  5. its own line. If "json" is passed as an optional argument then
  6. information provided by "typed" output is provided in JSON format as a
  7. list of JSON objects. By default, the format contains only two columns
  8. delimited by a colon (':'). The left one is the field name and the right
  9. one is the value. It is very important to note that in typed output
  10. format, the dump for a single object is contiguous so that there is no
  11. need for a consumer to store everything at once.
  12.  
  13. When using the typed output format, each line is made of 4 columns delimited
  14. by colons (':'). The first column is a dot-delimited series of 3 elements. The
  15. first element is the numeric position of the field in the list (starting at
  16. zero). This position shall not change over time, but holes are to be expected,
  17. depending on build options or if some fields are deleted in the future. The
  18. second element is the field name as it appears in the default "show info"
  19. output. The third element is the relative process number starting at 1.
  20.  
  21. The rest of the line starting after the first colon follows the "typed output
  22. format" described in the section above. In short, the second column (after the
  23. first ':') indicates the origin, nature and scope of the variable. The third
  24. column indicates the type of the field, among "s32", "s64", "u32", "u64" and
  25. "str". Then the fourth column is the value itself, which the consumer knows
  26. how to parse thanks to column 3 and how to process thanks to column 2.
  27.  
  28. Thus the overall line format in typed mode is :
  29.  
  30. <field_pos>.<field_name>.<process_num>:<tags>:<type>:<value>

Example :

  1. > show info
  2. Name: HAProxy
  3. Version: 1.7-dev1-de52ea-146
  4. Release_date: 2016/03/11
  5. Nbproc: 1
  6. Process_num: 1
  7. Pid: 28105
  8. Uptime: 0d 0h00m04s
  9. Uptime_sec: 4
  10. Memmax_MB: 0
  11. PoolAlloc_MB: 0
  12. PoolUsed_MB: 0
  13. PoolFailed: 0
  14. (...)
  15. > show info typed
  16. 0.Name.1:POS:str:HAProxy
  17. 1.Version.1:POS:str:1.7-dev1-de52ea-146
  18. 2.Release_date.1:POS:str:2016/03/11
  19. 3.Nbproc.1:CGS:u32:1
  20. 4.Process_num.1:KGP:u32:1
  21. 5.Pid.1:SGP:u32:28105
  22. 6.Uptime.1:MDP:str:0d 0h00m08s
  23. 7.Uptime_sec.1:MDP:u32:8
  24. 8.Memmax_MB.1:CLP:u32:0
  25. 9.PoolAlloc_MB.1:MGP:u32:0
  26. 10.PoolUsed_MB.1:MGP:u32:0
  27. 11.PoolFailed.1:MCP:u32:0
  28. (...)
  1. In the typed format, the presence of the process ID at the end of the
  2. first column makes it very easy to visually aggregate outputs from
  3. multiple processes.

Example :

  1. $ ( echo show info typed | socat /var/run/haproxy.sock1 ; \
  2. echo show info typed | socat /var/run/haproxy.sock2 ) | \
  3. sort -t . -k 1,1n -k 2,2 -k 3,3n
  4. 0.Name.1:POS:str:HAProxy
  5. 0.Name.2:POS:str:HAProxy
  6. 1.Version.1:POS:str:1.7-dev1-868ab3-148
  7. 1.Version.2:POS:str:1.7-dev1-868ab3-148
  8. 2.Release_date.1:POS:str:2016/03/11
  9. 2.Release_date.2:POS:str:2016/03/11
  10. 3.Nbproc.1:CGS:u32:2
  11. 3.Nbproc.2:CGS:u32:2
  12. 4.Process_num.1:KGP:u32:1
  13. 4.Process_num.2:KGP:u32:2
  14. 5.Pid.1:SGP:u32:30120
  15. 5.Pid.2:SGP:u32:30121
  16. 6.Uptime.1:MDP:str:0d 0h01m28s
  17. 6.Uptime.2:MDP:str:0d 0h01m28s
  18. (...)
  1. The format of JSON output is described in a schema which may be output
  2. using "show schema json".
  3.  
  4. The JSON output contains no extra whitespace in order to reduce the
  5. volume of output. For human consumption passing the output through a
  6. pretty printer may be helpful. Example :
  7.  
  8. $ echo "show info json" | socat /var/run/haproxy.sock stdio | \
  9. python -m json.tool
  10.  
  11. The JSON output contains no extra whitespace in order to reduce the
  12. volume of output. For human consumption passing the output through a
  13. pretty printer may be helpful. Example :
  14.  
  15. $ echo "show info json" | socat /var/run/haproxy.sock stdio | \
  16. python -m json.tool

show map []

  1. Dump info about map converters. Without argument, the list of all available
  2. maps is returned. If a <map> is specified, its contents are dumped. <map> is
  3. the #<id> or <file>. The first column is a unique identifier. It can be used
  4. as reference for the operation "del map" and "set map". The second column is
  5. the pattern and the third column is the sample if available. The data returned
  6. are not directly a list of available maps, but are the list of all patterns
  7. composing any map. Many of these patterns can be shared with ACL.

show peers []

  1. Dump info about the peers configured in "peers" sections. Without argument,
  2. the list of the peers belonging to all the "peers" sections are listed. If
  3. <peers section> is specified, only the information about the peers belonging
  4. to this "peers" section are dumped.
  5.  
  6. Here are two examples of outputs where hostA, hostB and hostC peers belong to
  7. "sharedlb" peers sections. Only hostA and hostB are connected. Only hostA has
  8. sent data to hostB.
  9.  
  10. $ echo "show peers" | socat - /tmp/hostA
  11. 0x55deb0224320: [15/Apr/2019:11:28:01] id=sharedlb state=0 flags=0x3 \
  12. resync_timeout=<PAST> task_calls=45122
  13. 0x55deb022b540: id=hostC(remote) addr=127.0.0.12:10002 status=CONN \
  14. reconnect=4s confirm=0
  15. flags=0x0
  16. 0x55deb022a440: id=hostA(local) addr=127.0.0.10:10000 status=NONE \
  17. reconnect=<NEVER> confirm=0
  18. flags=0x0
  19. 0x55deb0227d70: id=hostB(remote) addr=127.0.0.11:10001 status=ESTA
  20. reconnect=2s confirm=0
  21. flags=0x20000200 appctx:0x55deb028fba0 st0=7 st1=0 task_calls=14456 \
  22. state=EST
  23. xprt=RAW src=127.0.0.1:37257 addr=127.0.0.10:10000
  24. remote_table:0x55deb0224a10 id=stkt local_id=1 remote_id=1
  25. last_local_table:0x55deb0224a10 id=stkt local_id=1 remote_id=1
  26. shared tables:
  27. 0x55deb0224a10 local_id=1 remote_id=1 flags=0x0 remote_data=0x65
  28. last_acked=0 last_pushed=3 last_get=0 teaching_origin=0 update=3
  29. table:0x55deb022d6a0 id=stkt update=3 localupdate=3 \
  30. commitupdate=3 syncing=0
  31.  
  32. $ echo "show peers" | socat - /tmp/hostB
  33. 0x55871b5ab320: [15/Apr/2019:11:28:03] id=sharedlb state=0 flags=0x3 \
  34. resync_timeout=<PAST> task_calls=3
  35. 0x55871b5b2540: id=hostC(remote) addr=127.0.0.12:10002 status=CONN \
  36. reconnect=3s confirm=0
  37. flags=0x0
  38. 0x55871b5b1440: id=hostB(local) addr=127.0.0.11:10001 status=NONE \
  39. reconnect=<NEVER> confirm=0
  40. flags=0x0
  41. 0x55871b5aed70: id=hostA(remote) addr=127.0.0.10:10000 status=ESTA \
  42. reconnect=2s confirm=0
  43. flags=0x20000200 appctx:0x7fa46800ee00 st0=7 st1=0 task_calls=62356 \
  44. state=EST
  45. remote_table:0x55871b5ab960 id=stkt local_id=1 remote_id=1
  46. last_local_table:0x55871b5ab960 id=stkt local_id=1 remote_id=1
  47. shared tables:
  48. 0x55871b5ab960 local_id=1 remote_id=1 flags=0x0 remote_data=0x65
  49. last_acked=3 last_pushed=0 last_get=3 teaching_origin=0 update=0
  50. table:0x55871b5b46a0 id=stkt update=1 localupdate=0 \
  51. commitupdate=0 syncing=0

show pools

  1. Dump the status of internal memory pools. This is useful to track memory
  2. usage when suspecting a memory leak for example. It does exactly the same
  3. as the SIGQUIT when running in foreground except that it does not flush
  4. the pools.

show profiling

  1. Dumps the current profiling settings, one per line, as well as the command
  2. needed to change them.

show servers state []

  1. Dump the state of the servers found in the running configuration. A backend
  2. name or identifier may be provided to limit the output to this backend only.
  3.  
  4. The dump has the following format:
  5. - first line contains the format version (1 in this specification);
  6. - second line contains the column headers, prefixed by a sharp ('#');
  7. - third line and next ones contain data;
  8. - each line starting by a sharp ('#') is considered as a comment.
  9.  
  10. Since multiple versions of the output may co-exist, below is the list of
  11. fields and their order per file format version :
  12. 1:
  13. be_id: Backend unique id.
  14. be_name: Backend label.
  15. srv_id: Server unique id (in the backend).
  16. srv_name: Server label.
  17. srv_addr: Server IP address.
  18. srv_op_state: Server operational state (UP/DOWN/...).
  19. 0 = SRV_ST_STOPPED
  20. The server is down.
  21. 1 = SRV_ST_STARTING
  22. The server is warming up (up but
  23. throttled).
  24. 2 = SRV_ST_RUNNING
  25. The server is fully up.
  26. 3 = SRV_ST_STOPPING
  27. The server is up but soft-stopping
  28. (eg: 404).
  29. srv_admin_state: Server administrative state (MAINT/DRAIN/...).
  30. The state is actually a mask of values :
  31. 0x01 = SRV_ADMF_FMAINT
  32. The server was explicitly forced into
  33. maintenance.
  34. 0x02 = SRV_ADMF_IMAINT
  35. The server has inherited the maintenance
  36. status from a tracked server.
  37. 0x04 = SRV_ADMF_CMAINT
  38. The server is in maintenance because of
  39. the configuration.
  40. 0x08 = SRV_ADMF_FDRAIN
  41. The server was explicitly forced into
  42. drain state.
  43. 0x10 = SRV_ADMF_IDRAIN
  44. The server has inherited the drain status
  45. from a tracked server.
  46. 0x20 = SRV_ADMF_RMAINT
  47. The server is in maintenance because of an
  48. IP address resolution failure.
  49. 0x40 = SRV_ADMF_HMAINT
  50. The server FQDN was set from stats socket.
  51.  
  52. srv_uweight: User visible server's weight.
  53. srv_iweight: Server's initial weight.
  54. srv_time_since_last_change: Time since last operational change.
  55. srv_check_status: Last health check status.
  56. srv_check_result: Last check result (FAILED/PASSED/...).
  57. 0 = CHK_RES_UNKNOWN
  58. Initialized to this by default.
  59. 1 = CHK_RES_NEUTRAL
  60. Valid check but no status information.
  61. 2 = CHK_RES_FAILED
  62. Check failed.
  63. 3 = CHK_RES_PASSED
  64. Check succeeded and server is fully up
  65. again.
  66. 4 = CHK_RES_CONDPASS
  67. Check reports the server doesn't want new
  68. sessions.
  69. srv_check_health: Checks rise / fall current counter.
  70. srv_check_state: State of the check (ENABLED/PAUSED/...).
  71. The state is actually a mask of values :
  72. 0x01 = CHK_ST_INPROGRESS
  73. A check is currently running.
  74. 0x02 = CHK_ST_CONFIGURED
  75. This check is configured and may be
  76. enabled.
  77. 0x04 = CHK_ST_ENABLED
  78. This check is currently administratively
  79. enabled.
  80. 0x08 = CHK_ST_PAUSED
  81. Checks are paused because of maintenance
  82. (health only).
  83. srv_agent_state: State of the agent check (ENABLED/PAUSED/...).
  84. This state uses the same mask values as
  85. "srv_check_state", adding this specific one :
  86. 0x10 = CHK_ST_AGENT
  87. Check is an agent check (otherwise it's a
  88. health check).
  89. bk_f_forced_id: Flag to know if the backend ID is forced by
  90. configuration.
  91. srv_f_forced_id: Flag to know if the server's ID is forced by
  92. configuration.
  93. srv_fqdn: Server FQDN.
  94. srv_port: Server port.
  95. srvrecord: DNS SRV record associated to this SRV.

show sess

  1. Dump all known sessions. Avoid doing this on slow connections as this can
  2. be huge. This command is restricted and can only be issued on sockets
  3. configured for levels "operator" or "admin".

show sess

  1. Display a lot of internal information about the specified session identifier.
  2. This identifier is the first field at the beginning of the lines in the dumps
  3. of "show sess" (it corresponds to the session pointer). Those information are
  4. useless to most users but may be used by haproxy developers to troubleshoot a
  5. complex bug. The output format is intentionally not documented so that it can
  6. freely evolve depending on demands. You may find a description of all fields
  7. returned in src/dumpstats.c
  8.  
  9. The special id "all" dumps the states of all sessions, which must be avoided
  10. as much as possible as it is highly CPU intensive and can take a lot of time.

show stat [{|} ] [typed|json]

  1. Dump statistics using the CSV format; using the extended typed output
  2. format described in the section above if "typed" is passed after the
  3. other arguments; or in JSON if "json" is passed after the other arguments
  4. . By passing <id>, <type> and <sid>, it is possible to dump only selected
  5. items :
  6. - <iid> is a proxy ID, -1 to dump everything. Alternatively, a proxy name
  7. <proxy> may be specified. In this case, this proxy's ID will be used as
  8. the ID selector.
  9. - <type> selects the type of dumpable objects : 1 for frontends, 2 for
  10. backends, 4 for servers, -1 for everything. These values can be ORed,
  11. for example:
  12. 1 + 2 = 3 -> frontend + backend.
  13. 1 + 2 + 4 = 7 -> frontend + backend + server.
  14. - <sid> is a server ID, -1 to dump everything from the selected proxy.

Example :

  1. $ echo "show info;show stat" | socat stdio unix-connect:/tmp/sock1
  2. >>> Name: HAProxy
  3. Version: 1.4-dev2-49
  4. Release_date: 2009/09/23
  5. Nbproc: 1
  6. Process_num: 1
  7. (...)
  8. # pxname,svname,qcur,qmax,scur,smax,slim,stot,bin,bout,dreq, (...)
  9. stats,FRONTEND,,,0,0,1000,0,0,0,0,0,0,,,,,OPEN,,,,,,,,,1,1,0, (...)
  10. stats,BACKEND,0,0,0,0,1000,0,0,0,0,0,,0,0,0,0,UP,0,0,0,,0,250,(...)
  11. (...)
  12. www1,BACKEND,0,0,0,0,1000,0,0,0,0,0,,0,0,0,0,UP,1,1,0,,0,250, (...)
  13. $
  1. In this example, two commands have been issued at once. That way it's easy to
  2. find which process the stats apply to in multi-process mode. This is not
  3. needed in the typed output format as the process number is reported on each
  4. line. Notice the empty line after the information output which marks the end
  5. of the first block. A similar empty line appears at the end of the second
  6. block (stats) so that the reader knows the output has not been truncated.
  7.  
  8. When "typed" is specified, the output format is more suitable to monitoring
  9. tools because it provides numeric positions and indicates the type of each
  10. output field. Each value stands on its own line with process number, element
  11. number, nature, origin and scope. This same format is available via the HTTP
  12. stats by passing ";typed" after the URI. It is very important to note that in
  13. typed output format, the dump for a single object is contiguous so that there
  14. is no need for a consumer to store everything at once.
  15.  
  16. When using the typed output format, each line is made of 4 columns delimited
  17. by colons (':'). The first column is a dot-delimited series of 5 elements. The
  18. first element is a letter indicating the type of the object being described.
  19. At the moment the following object types are known : 'F' for a frontend, 'B'
  20. for a backend, 'L' for a listener, and 'S' for a server. The second element
  21. The second element is a positive integer representing the unique identifier of
  22. the proxy the object belongs to. It is equivalent to the "iid" column of the
  23. CSV output and matches the value in front of the optional "id" directive found
  24. in the frontend or backend section. The third element is a positive integer
  25. containing the unique object identifier inside the proxy, and corresponds to
  26. the "sid" column of the CSV output. ID 0 is reported when dumping a frontend
  27. or a backend. For a listener or a server, this corresponds to their respective
  28. ID inside the proxy. The fourth element is the numeric position of the field
  29. in the list (starting at zero). This position shall not change over time, but
  30. holes are to be expected, depending on build options or if some fields are
  31. deleted in the future. The fifth element is the field name as it appears in
  32. the CSV output. The sixth element is a positive integer and is the relative
  33. process number starting at 1.
  34.  
  35. The rest of the line starting after the first colon follows the "typed output
  36. format" described in the section above. In short, the second column (after the
  37. first ':') indicates the origin, nature and scope of the variable. The third
  38. column indicates the type of the field, among "s32", "s64", "u32", "u64" and
  39. "str". Then the fourth column is the value itself, which the consumer knows
  40. how to parse thanks to column 3 and how to process thanks to column 2.
  41.  
  42. Thus the overall line format in typed mode is :
  43.  
  44. <obj>.<px_id>.<id>.<fpos>.<fname>.<process_num>:<tags>:<type>:<value>
  45.  
  46. Here's an example of typed output format :
  47.  
  48. $ echo "show stat typed" | socat stdio unix-connect:/tmp/sock1
  49. F.2.0.0.pxname.1:MGP:str:private-frontend
  50. F.2.0.1.svname.1:MGP:str:FRONTEND
  51. F.2.0.8.bin.1:MGP:u64:0
  52. F.2.0.9.bout.1:MGP:u64:0
  53. F.2.0.40.hrsp_2xx.1:MGP:u64:0
  54. L.2.1.0.pxname.1:MGP:str:private-frontend
  55. L.2.1.1.svname.1:MGP:str:sock-1
  56. L.2.1.17.status.1:MGP:str:OPEN
  57. L.2.1.73.addr.1:MGP:str:0.0.0.0:8001
  58. S.3.13.60.rtime.1:MCP:u32:0
  59. S.3.13.61.ttime.1:MCP:u32:0
  60. S.3.13.62.agent_status.1:MGP:str:L4TOUT
  61. S.3.13.64.agent_duration.1:MGP:u64:2001
  62. S.3.13.65.check_desc.1:MCP:str:Layer4 timeout
  63. S.3.13.66.agent_desc.1:MCP:str:Layer4 timeout
  64. S.3.13.67.check_rise.1:MCP:u32:2
  65. S.3.13.68.check_fall.1:MCP:u32:3
  66. S.3.13.69.check_health.1:SGP:u32:0
  67. S.3.13.70.agent_rise.1:MaP:u32:1
  68. S.3.13.71.agent_fall.1:SGP:u32:1
  69. S.3.13.72.agent_health.1:SGP:u32:1
  70. S.3.13.73.addr.1:MCP:str:1.255.255.255:8888
  71. S.3.13.75.mode.1:MAP:str:http
  72. B.3.0.0.pxname.1:MGP:str:private-backend
  73. B.3.0.1.svname.1:MGP:str:BACKEND
  74. B.3.0.2.qcur.1:MGP:u32:0
  75. B.3.0.3.qmax.1:MGP:u32:0
  76. B.3.0.4.scur.1:MGP:u32:0
  77. B.3.0.5.smax.1:MGP:u32:0
  78. B.3.0.6.slim.1:MGP:u32:1000
  79. B.3.0.55.lastsess.1:MMP:s32:-1
  80. (...)
  81.  
  82. In the typed format, the presence of the process ID at the end of the
  83. first column makes it very easy to visually aggregate outputs from
  84. multiple processes, as show in the example below where each line appears
  85. for each process :
  86.  
  87. $ ( echo show stat typed | socat /var/run/haproxy.sock1 - ; \
  88. echo show stat typed | socat /var/run/haproxy.sock2 - ) | \
  89. sort -t . -k 1,1 -k 2,2n -k 3,3n -k 4,4n -k 5,5 -k 6,6n
  90. B.3.0.0.pxname.1:MGP:str:private-backend
  91. B.3.0.0.pxname.2:MGP:str:private-backend
  92. B.3.0.1.svname.1:MGP:str:BACKEND
  93. B.3.0.1.svname.2:MGP:str:BACKEND
  94. B.3.0.2.qcur.1:MGP:u32:0
  95. B.3.0.2.qcur.2:MGP:u32:0
  96. B.3.0.3.qmax.1:MGP:u32:0
  97. B.3.0.3.qmax.2:MGP:u32:0
  98. B.3.0.4.scur.1:MGP:u32:0
  99. B.3.0.4.scur.2:MGP:u32:0
  100. B.3.0.5.smax.1:MGP:u32:0
  101. B.3.0.5.smax.2:MGP:u32:0
  102. B.3.0.6.slim.1:MGP:u32:1000
  103. B.3.0.6.slim.2:MGP:u32:1000
  104. (...)
  105.  
  106. The format of JSON output is described in a schema which may be output
  107. using "show schema json".
  108.  
  109. The JSON output contains no extra whitespace in order to reduce the
  110. volume of output. For human consumption passing the output through a
  111. pretty printer may be helpful. Example :
  112.  
  113. $ echo "show stat json" | socat /var/run/haproxy.sock stdio | \
  114. python -m json.tool
  115.  
  116. The JSON output contains no extra whitespace in order to reduce the
  117. volume of output. For human consumption passing the output through a
  118. pretty printer may be helpful. Example :
  119.  
  120. $ echo "show stat json" | socat /var/run/haproxy.sock stdio | \
  121. python -m json.tool

show resolvers []

  1. Dump statistics for the given resolvers section, or all resolvers sections
  2. if no section is supplied.
  3.  
  4. For each name server, the following counters are reported:
  5. sent: number of DNS requests sent to this server
  6. valid: number of DNS valid responses received from this server
  7. update: number of DNS responses used to update the server's IP address
  8. cname: number of CNAME responses
  9. cname_error: CNAME errors encountered with this server
  10. any_err: number of empty response (IE: server does not support ANY type)
  11. nx: non existent domain response received from this server
  12. timeout: how many time this server did not answer in time
  13. refused: number of requests refused by this server
  14. other: any other DNS errors
  15. invalid: invalid DNS response (from a protocol point of view)
  16. too_big: too big response
  17. outdated: number of response arrived too late (after an other name server)

show table

  1. Dump general information on all known stick-tables. Their name is returned
  2. (the name of the proxy which holds them), their type (currently zero, always
  3. IP), their size in maximum possible number of entries, and the number of
  4. entries currently in use.

Example :

  1. $ echo "show table" | socat stdio /tmp/sock1
  2. >>> # table: front_pub, type: ip, size:204800, used:171454
  3. >>> # table: back_rdp, type: ip, size:204800, used:0

show table [ data. ] | [ key ]

  1. Dump contents of stick-table <name>. In this mode, a first line of generic
  2. information about the table is reported as with "show table", then all
  3. entries are dumped. Since this can be quite heavy, it is possible to specify
  4. a filter in order to specify what entries to display.
  5.  
  6. When the "data." form is used the filter applies to the stored data (see
  7. "stick-table" in section 4.2). A stored data type must be specified
  8. in <type>, and this data type must be stored in the table otherwise an
  9. error is reported. The data is compared according to <operator> with the
  10. 64-bit integer <value>. Operators are the same as with the ACLs :
  11.  
  12. - eq : match entries whose data is equal to this value
  13. - ne : match entries whose data is not equal to this value
  14. - le : match entries whose data is less than or equal to this value
  15. - ge : match entries whose data is greater than or equal to this value
  16. - lt : match entries whose data is less than this value
  17. - gt : match entries whose data is greater than this value
  18.  
  19.  
  20. When the key form is used the entry <key> is shown. The key must be of the
  21. same type as the table, which currently is limited to IPv4, IPv6, integer,
  22. and string.

Example :

  1. $ echo "show table http_proxy" | socat stdio /tmp/sock1
  2. >>> # table: http_proxy, type: ip, size:204800, used:2
  3. >>> 0x80e6a4c: key=127.0.0.1 use=0 exp=3594729 gpc0=0 conn_rate(30000)=1 \
  4. bytes_out_rate(60000)=187
  5. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  6. bytes_out_rate(60000)=191
  7. $ echo "show table http_proxy data.gpc0 gt 0" | socat stdio /tmp/sock1
  8. >>> # table: http_proxy, type: ip, size:204800, used:2
  9. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  10. bytes_out_rate(60000)=191
  11. $ echo "show table http_proxy data.conn_rate gt 5" | \
  12. socat stdio /tmp/sock1
  13. >>> # table: http_proxy, type: ip, size:204800, used:2
  14. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  15. bytes_out_rate(60000)=191
  16. $ echo "show table http_proxy key 127.0.0.2" | \
  17. socat stdio /tmp/sock1
  18. >>> # table: http_proxy, type: ip, size:204800, used:2
  19. >>> 0x80e6a80: key=127.0.0.2 use=0 exp=3594740 gpc0=1 conn_rate(30000)=10 \
  20. bytes_out_rate(60000)=191
  1. When the data criterion applies to a dynamic value dependent on time such as
  2. a bytes rate, the value is dynamically computed during the evaluation of the
  3. entry in order to decide whether it has to be dumped or not. This means that
  4. such a filter could match for some time then not match anymore because as
  5. time goes, the average event rate drops.
  6.  
  7. It is possible to use this to extract lists of IP addresses abusing the
  8. service, in order to monitor them or even blacklist them in a firewall.

Example :

  1. $ echo "show table http_proxy data.gpc0 gt 0" \
  2. | socat stdio /tmp/sock1 \
  3. | fgrep &#x27;key=' | cut -d' ' -f2 | cut -d= -f2 > abusers-ip.txt
  4. ( or | awk &#x27;/key/{ print a[split($2,a,"=")]; }' )

show threads

  1. Dumps some internal states and structures for each thread, that may be useful
  2. to help developers understand a problem. The output tries to be readable by
  3. showing one block per thread. When haproxy is built with USE_THREAD_DUMP=1,
  4. an advanced dump mechanism involving thread signals is used so that each
  5. thread can dump its own state in turn. Without this option, the thread
  6. processing the command shows all its details but the other ones are less
  7. detailed. A star ('*') is displayed in front of the thread handling the
  8. command. A right angle bracket ('>') may also be displayed in front of
  9. threads which didn't make any progress since last invocation of this command,
  10. indicating a bug in the code which must absolutely be reported. When this
  11. happens between two threads it usually indicates a deadlock. If a thread is
  12. alone, it's a different bug like a corrupted list. In all cases the process
  13. needs is not fully functional anymore and needs to be restarted.
  14.  
  15. The output format is purposely not documented so that it can easily evolve as
  16. new needs are identified, without having to maintain any form of backwards
  17. compatibility, and just like with "show activity", the values are meaningless
  18. without the code at hand.

show tls-keys [id|*]

  1. Dump all loaded TLS ticket keys references. The TLS ticket key reference ID
  2. and the file from which the keys have been loaded is shown. Both of those
  3. can be used to update the TLS keys using "set ssl tls-key". If an ID is
  4. specified as parameter, it will dump the tickets, using * it will dump every
  5. keys from every references.

show schema json

  1. Dump the schema used for the output of "show info json" and "show stat json".
  2.  
  3. The contains no extra whitespace in order to reduce the volume of output.
  4. For human consumption passing the output through a pretty printer may be
  5. helpful. Example :
  6.  
  7. $ echo "show schema json" | socat /var/run/haproxy.sock stdio | \
  8. python -m json.tool
  9.  
  10. The schema follows "JSON Schema" (json-schema.org) and accordingly
  11. verifiers may be used to verify the output of "show info json" and "show
  12. stat json" against the schema.

shutdown frontend

  1. Completely delete the specified frontend. All the ports it was bound to will
  2. be released. It will not be possible to enable the frontend anymore after
  3. this operation. This is intended to be used in environments where stopping a
  4. proxy is not even imaginable but a misconfigured proxy must be fixed. That
  5. way it's possible to release the port and bind it into another process to
  6. restore operations. The frontend will not appear at all on the stats page
  7. once it is terminated.
  8.  
  9. The frontend may be specified either by its name or by its numeric ID,
  10. prefixed with a sharp ('#').
  11.  
  12. This command is restricted and can only be issued on sockets configured for
  13. level "admin".

shutdown session

  1. Immediately terminate the session matching the specified session identifier.
  2. This identifier is the first field at the beginning of the lines in the dumps
  3. of "show sess" (it corresponds to the session pointer). This can be used to
  4. terminate a long-running session without waiting for a timeout or when an
  5. endless transfer is ongoing. Such terminated sessions are reported with a 'K'
  6. flag in the logs.

shutdown sessions server /

  1. Immediately terminate all the sessions attached to the specified server. This
  2. can be used to terminate long-running sessions after a server is put into
  3. maintenance mode, for instance. Such terminated sessions are reported with a
  4. 'K' flag in the logs.