Adds a global syslog server. Several global servers can be defined. They
will receive logs for starts and exits, as well as all logs from proxies
configured with "log global".
 
<address> can be one of:
 
      - An IPv4 address optionally followed by a colon and a UDP port. If
        no port is specified, 514 is used by default (the standard syslog
        port).
 
      - An IPv6 address followed by a colon and optionally a UDP port. If
        no port is specified, 514 is used by default (the standard syslog
        port).
 
      - A filesystem path to a datagram UNIX domain socket, keeping in mind
        considerations for chroot (be sure the path is accessible inside
        the chroot) and uid/gid (be sure the path is appropriately
        writable).
 
      - A file descriptor number in the form "fd@<number>", which may point
        to a pipe, terminal, or socket. In this case unbuffered logs are used
        and one writev() call per log is performed. This is a bit expensive
        but acceptable for most workloads. Messages sent this way will not be
        truncated but may be dropped, in which case the DroppedLogs counter
        will be incremented. The writev() call is atomic even on pipes for
        messages up to PIPE_BUF size, which POSIX recommends to be at least
        512 and which is 4096 bytes on most modern operating systems. Any
        larger message may be interleaved with messages from other processes.
        Exceptionally for debugging purposes the file descriptor may also be
        directed to a file, but doing so will significantly slow haproxy down
        as non-blocking calls will be ignored. Also there will be no way to
        purge nor rotate this file without restarting the process. Note that
        the configured syslog format is preserved, so the output is suitable
        for use with a TCP syslog server. See also the "short" and "raw"
        format below.
 
      - "stdout" / "stderr", which are respectively aliases for "fd@1" and
        "fd@2", see above.
 
      You may want to reference some environment variables in the address
      parameter, see section 2.3 about environment variables.
 
<length> is an optional maximum line length. Log lines larger than this value
         will be truncated before being sent. The reason is that syslog
         servers act differently on log line length. All servers support the
         default value of 1024, but some servers simply drop larger lines
         while others do log them. If a server supports long lines, it may
         make sense to set this value here in order to avoid truncating long
         lines. Similarly, if a server drops long lines, it is preferable to
         truncate them before sending them. Accepted values are 80 to 65535
         inclusive. The default value of 1024 is generally fine for all
         standard usages. Some specific cases of long captures or
         JSON-formatted logs may require larger values. You may also need to
         increase "tune.http.logurilen" if your request URIs are truncated.
 
<format> is the log format used when generating syslog messages. It may be
         one of the following :
 
  rfc3164   The RFC3164 syslog message format. This is the default.
            (https://tools.ietf.org/html/rfc3164)
 
  rfc5424   The RFC5424 syslog message format.
            (https://tools.ietf.org/html/rfc5424)
 
  short     A message containing only a level between angle brackets such as
            '<3>', followed by the text. The PID, date, time, process name
            and system name are omitted. This is designed to be used with a
            local log server. This format is compatible with what the systemd
            logger consumes.
 
  raw       A message containing only the text. The level, PID, date, time,
            process name and system name are omitted. This is designed to be
            used in containers or during development, where the severity only
            depends on the file descriptor used (stdout/stderr).
 
<ranges>   A list of comma-separated ranges to identify the logs to sample.
           This is used to balance the load of the logs to send to the log
           server. The limits of the ranges cannot be null. They are numbered
           from 1. The size or period (in number of logs) of the sample must be
           set with <sample_size> parameter.
 
<sample_size>
           The size of the sample in number of logs to consider when balancing
           their logging loads. It is used to balance the load of the logs to
           send to the syslog server. This size must be greater or equal to the
           maximum of the high limits of the ranges.
           (see also <ranges> parameter).
 
<facility> must be one of the 24 standard syslog facilities :
 
               kern   user   mail   daemon auth   syslog lpr    news
               uucp   cron   auth2  ftp    ntp    audit  alert  cron2
               local0 local1 local2 local3 local4 local5 local6 local7
 
           Note that the facility is ignored for the "short" and "raw"
           formats, but still required as a positional field. It is
           recommended to use "daemon" in this case to make it clear that
           it's only supposed to be used locally.
 
An optional level can be specified to filter outgoing messages. By default,
all messages are sent. If a maximum level is specified, only messages with a
severity at least as important as this level will be sent. An optional minimum
level can be specified. If it is set, logs emitted with a more severe level
than this one will be capped to this level. This is used to avoid sending
"emerg" messages on all terminals on some default syslog configurations.
Eight levels are known :
 
        emerg  alert  crit   err    warning notice info  debug

log-send-hostname []

Sets the hostname field in the syslog header. If optional "string" parameter
is set the header is set to the string contents, otherwise uses the hostname
of the system. Generally used if one is not relaying logs through an
intermediate syslog server or for simply customizing the hostname printed in
the logs.

log-tag

Sets the tag field in the syslog header to this string. It defaults to the
program name as launched from the command line, which usually is "haproxy".
Sometimes it can be useful to differentiate between multiple processes
running on the same host. See also the per-proxy "log-tag
This keyword is available in sections :
Process management and security
Alphabetically sorted keywords reference
" directive.

lua-load

This global directive loads and executes a Lua file. This directive can be
used multiple times.

master-worker [no-exit-on-failure]

Master-worker mode. It is equivalent to the command line "-W" argument.
This mode will launch a "master" which will monitor the "workers". Using
this mode, you can reload HAProxy directly by sending a SIGUSR2 signal to
the master. The master-worker mode is compatible either with the foreground
or daemon mode. It is recommended to use this mode with multiprocess and
systemd.
By default, if a worker exits with a bad return code, in the case of a
segfault for example, all workers will be killed, and the master will leave.
It is convenient to combine this behavior with Restart=on-failure in a
systemd unit file in order to relaunch the whole process. If you don't want
this behavior, you must use the keyword "no-exit-on-failure".
 
See also "-W" in the management guide.

mworker-max-reloads

In master-worker mode, this option limits the number of time a worker can
survive to a reload. If the worker did not leave after a reload, once its
number of reloads is greater than this number, the worker will receive a
SIGTERM. This option helps to keep under control the number of workers.
See also "show proc" in the Management Guide.

nbproc

Creates <number> processes when going daemon. This requires the "daemon"
mode. By default, only one process is created, which is the recommended mode
of operation. For systems limited to small sets of file descriptors per
process, it may be needed to fork multiple daemons. When set to a value
larger than 1, threads are automatically disabled. USING MULTIPLE PROCESSES
IS HARDER TO DEBUG AND IS REALLY DISCOURAGED. See also "daemon" and
"nbthread".

nbthread

This setting is only available when support for threads was built in. It
makes haproxy run on <number> threads. This is exclusive with "nbproc
This keyword is available in sections :
Process management and security
Fetching samples from internal states
". While
"nbproc
This keyword is available in sections :
Process management and security
Fetching samples from internal states
" historically used to be the only way to use multiple processors, it
also involved a number of shortcomings related to the lack of synchronization
between processes (health-checks, peers, stick-tables, stats, ...) which do
not affect threads. As such, any modern configuration is strongly encouraged
to migrate away from "nbproc
This keyword is available in sections :
Process management and security
Fetching samples from internal states
" to "nbthread". "nbthread" also works when
HAProxy is started in foreground. On some platforms supporting CPU affinity,
when nbproc is not used, the default "nbthread" value is automatically set to
the number of CPUs the process is bound to upon startup. This means that the
thread count can easily be adjusted from the calling process using commands
like "taskset" or "cpuset". Otherwise, this value defaults to 1. The default
value is reported in the output of "haproxy -vv". See also "nbproc
This keyword is available in sections :
Process management and security
Fetching samples from internal states
".

pidfile

Writes PIDs of all daemons into file <pidfile>. This option is equivalent to
the "-p" command line argument. The file must be accessible to the user
starting the process. See also "daemon".

presetenv

Sets environment variable <name> to value <value>. If the variable exists, it
is NOT overwritten. The changes immediately take effect so that the next line
in the configuration file sees the new value. See also "setenv", "resetenv",
and "unsetenv".

resetenv [ …]

Removes all environment variables except the ones specified in argument. It
allows to use a clean controlled environment before setting new values with
setenv or unsetenv. Please note that some internal functions may make use of
some environment variables, such as time manipulation functions, but also
OpenSSL or even external checks. This must be used with extreme care and only
after complete validation. The changes immediately take effect so that the
next line in the configuration file sees the new environment. See also
"setenv", "presetenv", and "unsetenv".

stats bind-process [ all | odd | even | [-[process_num>]] ] …

Limits the stats socket to a certain set of processes numbers. By default the
stats socket is bound to all processes, causing a warning to be emitted when
nbproc is greater than 1 because there is no way to select the target process
when connecting. However, by using this setting, it becomes possible to pin
the stats socket to a specific set of processes, typically the first one. The
warning will automatically be disabled when this setting is used, whatever
the number of processes used. The maximum process ID depends on the machine's
word size (32 or 64). Ranges can be partially defined. The higher bound can
be omitted. In such case, it is replaced by the corresponding maximum
value. A better option consists in using the "process" setting of the "stats
socket" line to force the process on each line.

server-state-base

Specifies the directory prefix to be prepended in front of all servers state
file names which do not start with a '/'. See also "server-state-file",
"load-server-state-from-file" and "server-state-file-name".

server-state-file

Specifies the path to the file containing state of servers. If the path starts
with a slash ('/'), it is considered absolute, otherwise it is considered
relative to the directory specified using "server-state-base" (if set) or to
the current directory. Before reloading HAProxy, it is possible to save the
servers' current state using the stats command "show servers state". The
output of this command must be written in the file pointed by <file>. When
starting up, before handling traffic, HAProxy will read, load and apply state
for each server found in the file and available in its current running
configuration. See also "server-state-base" and "show servers state",
"load-server-state-from-file" and "server-state-file-name"

setenv

Sets environment variable <name> to value <value>. If the variable exists, it
is overwritten. The changes immediately take effect so that the next line in
the configuration file sees the new value. See also "presetenv", "resetenv",
and "unsetenv".

set-dumpable

This option is better left disabled by default and enabled only upon a
developer's request. It has no impact on performance nor stability but will
try hard to re-enable core dumps that were possibly disabled by file size
limitations (ulimit -f), core size limitations (ulimit -c), or "dumpability"
of a process after changing its UID/GID (such as /proc/sys/fs/suid_dumpable
on Linux). Core dumps might still be limited by the current directory's
permissions (check what directory the file is started from), the chroot
directory's permission (it may be needed to temporarily disable the chroot
directive or to move it to a dedicated writable location), or any other
system-specific constraint. For example, some Linux flavours are notorious
for replacing the default core file with a path to an executable not even
installed on the system (check /proc/sys/kernel/core_pattern). Often, simply
writing "core", "core.%p" or "/var/log/core/core.%p" addresses the issue.
When trying to enable this option waiting for a rare issue to re-appear, it's
often a good idea to first try to obtain such a dump by issuing, for example,
"kill -11" to the haproxy process and verify that it leaves a core where
expected when dying.

ssl-default-bind-ciphers

This setting is only available when support for OpenSSL was built in. It sets
the default string describing the list of cipher algorithms ("cipher suite")
that are negotiated during the SSL/TLS handshake up to TLSv1.2 for all
"bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines which do not explicitly define theirs. The format of the string
is defined in "man 1 ciphers" from OpenSSL man pages. For background
information and recommendations see e.g.
(https://wiki.mozilla.org/Security/Server_Side_TLS) and
(https://mozilla.github.io/server-side-tls/ssl-config-generator/). For TLSv1.3
cipher configuration, please check the "ssl-default-bind-ciphersuites" keyword.
Please check the "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" keyword for more information.

ssl-default-bind-ciphersuites

This setting is only available when support for OpenSSL was built in and
OpenSSL 1.1.1 or later was used to build HAProxy. It sets the default string
describing the list of cipher algorithms ("cipher suite") that are negotiated
during the TLSv1.3 handshake for all "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines which do not explicitly define
theirs. The format of the string is defined in
"man 1 ciphers" from OpenSSL man pages under the section "ciphersuites
This keyword is available in sections :
Bind options
Server and default-server options
". For
cipher configuration for TLSv1.2 and earlier, please check the
"ssl-default-bind-ciphers" keyword. Please check the "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" keyword for more
information.

ssl-default-bind-options []…

This setting is only available when support for OpenSSL was built in. It sets
default ssl-options to force on all "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines. Please check the "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
"
keyword to see available options.

Example:

global
   ssl-default-bind-options ssl-min-ver TLSv1.0 no-tls-tickets

ssl-default-server-ciphers

This setting is only available when support for OpenSSL was built in. It
sets the default string describing the list of cipher algorithms that are
negotiated during the SSL/TLS handshake up to TLSv1.2 with the server,
for all "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines which do not explicitly define theirs. The format of
the string is defined in "man 1 ciphers" from OpenSSL man pages. For background
information and recommendations see e.g.
(https://wiki.mozilla.org/Security/Server_Side_TLS) and
(https://mozilla.github.io/server-side-tls/ssl-config-generator/).
For TLSv1.3 cipher configuration, please check the
"ssl-default-server-ciphersuites" keyword. Please check the "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" keyword
for more information.

ssl-default-server-ciphersuites

This setting is only available when support for OpenSSL was built in and
OpenSSL 1.1.1 or later was used to build HAProxy. It sets the default
string describing the list of cipher algorithms that are negotiated during
the TLSv1.3 handshake with the server, for all "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines which do not
explicitly define theirs. The format of the string is defined in
"man 1 ciphers" from OpenSSL man pages under the section "ciphersuites
This keyword is available in sections :
Bind options
Server and default-server options
". For
cipher configuration for TLSv1.2 and earlier, please check the
"ssl-default-server-ciphers" keyword. Please check the "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" keyword for
more information.

ssl-default-server-options []…

This setting is only available when support for OpenSSL was built in. It sets
default ssl-options to force on all "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines. Please check the "server
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
"
keyword to see available options.

ssl-dh-param-file

This setting is only available when support for OpenSSL was built in. It sets
the default DH parameters that are used during the SSL/TLS handshake when
ephemeral Diffie-Hellman (DHE) key exchange is used, for all "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines
which do not explicitly define theirs. It will be overridden by custom DH
parameters found in a bind certificate file if any. If custom DH parameters
are not specified either by using ssl-dh-param-file or by setting them
directly in the certificate file, pre-generated DH parameters of the size
specified by tune.ssl.default-dh-param will be used. Custom parameters are
known to be more secure and therefore their use is recommended.
Custom DH parameters may be generated by using the OpenSSL command
"openssl dhparam <size>", where size should be at least 2048, as 1024-bit DH
parameters should not be considered secure anymore.

ssl-server-verify [none|required]

The default behavior for SSL verify on servers side. If specified to 'none',
servers certificates are not verified. The default is 'required' except if
forced using cmdline option '-dV'.

stats socket [|] [param*]

Binds a UNIX socket to <path> or a TCPv4/v6 address to <address:port>.
Connections to this socket will return various statistics outputs and even
allow some commands to be issued to change some runtime settings. Please
consult section 9.3 "Unix Socket commands" of Management Guide for more
details.
 
All parameters supported by "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" lines are supported, for instance to
restrict access to some users or their access rights. Please consult
section 5.1 for more information.

stats timeout

The default timeout on the stats socket is set to 10 seconds. It is possible
to change this value with "stats timeout". The value must be passed in
milliseconds, or be suffixed by a time unit among { us, ms, s, m, h, d }.

stats maxconn

By default, the stats socket is limited to 10 concurrent connections. It is
possible to change this value with "stats maxconn".

uid

Changes the process' user ID to <number>. It is recommended that the user ID
is dedicated to HAProxy or to a small set of similar daemons. HAProxy must
be started with superuser privileges in order to be able to switch to another
one. See also "gid
This keyword is available in sections :
Process management and security
Bind options
" and "user
This keyword is available in sections :
Process management and security
Userlists
Bind options
".

ulimit-n

Sets the maximum number of per-process file-descriptors to <number>. By
default, it is automatically computed, so it is recommended not to use this
option.

unix-bind [ prefix ] [ mode ] [ user ] [ uid ] [ group ] [ gid ]

Fixes common settings to UNIX listening sockets declared in "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" statements.
This is mainly used to simplify declaration of those UNIX sockets and reduce
the risk of errors, since those settings are most commonly required but are
also process-specific. The <prefix> setting can be used to force all socket
path to be relative to that directory. This might be needed to access another
component's chroot. Note that those paths are resolved before haproxy chroots
itself, so they are absolute. The <mode>, <user>, <uid>, <group> and <gid>
all have the same meaning as their homonyms used by the "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" statement. If
both are specified, the "bind
This keyword is available in sections :
Peers
Alphabetically sorted keywords reference
" statement has priority, meaning that the
"unix-bind" settings may be seen as process-wide default settings.

unsetenv [ …]

Removes environment variables specified in arguments. This can be useful to
hide some sensitive information that are occasionally inherited from the
user's environment during some operations. Variables which did not exist are
silently ignored so that after the operation, it is certain that none of
these variables remain. The changes immediately take effect so that the next
line in the configuration file will not see these variables. See also
"setenv", "presetenv", and "resetenv".

user

Similar to "uid
This keyword is available in sections :
Process management and security
Bind options
" but uses the UID of user name <user name> from /etc/passwd.
See also "uid
This keyword is available in sections :
Process management and security
Bind options
" and "group
This keyword is available in sections :
Process management and security
Userlists
Bind options
".

node

Only letters, digits, hyphen and underscore are allowed, like in DNS names.
 
This statement is useful in HA configurations where two or more processes or
servers share the same IP address. By setting a different node-name on all
nodes, it becomes easy to immediately spot what server is handling the
traffic.

description

Add a text that describes the instance.
 
Please note that it is required to escape certain characters (# for example)
and this text is inserted into a html page so you should avoid using
"<" and ">" characters.

51degrees-data-file

The path of the 51Degrees data file to provide device detection services. The
file should be unzipped and accessible by HAProxy with relevant permissions.
 
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.

51degrees-property-name-list [ …]

A list of 51Degrees property names to be load from the dataset. A full list
of names is available on the 51Degrees website:
https://51degrees.com/resources/property-dictionary
 
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.

51degrees-property-separator

A char that will be appended to every property value in a response header
containing 51Degrees results. If not set that will be set as ','.
 
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.

51degrees-cache-size

Sets the size of the 51Degrees converter cache to <number> entries. This
is an LRU cache which reminds previous device detections and their results.
By default, this cache is disabled.
 
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.

wurfl-data-file

The path of the WURFL data file to provide device detection services. The
file should be accessible by HAProxy with relevant permissions.
 
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.

wurfl-information-list []*

A space-delimited list of WURFL capabilities, virtual capabilities, property
names we plan to use in injected headers. A full list of capability and
virtual capability names is available on the Scientiamobile website :
 
    https://www.scientiamobile.com/wurflCapability
 
Valid WURFL properties are:
- wurfl_id                    Contains the device ID of the matched device.
 
- wurfl_root_id               Contains the device root ID of the matched
                              device.
 
- wurfl_isdevroot             Tells if the matched device is a root device.
                              Possible values are "TRUE" or "FALSE".
 
- wurfl_useragent             The original useragent coming with this
                              particular web request.
 
- wurfl_api_version           Contains a string representing the currently
                              used Libwurfl API version.
 
- wurfl_info                  A string containing information on the parsed
                              wurfl.xml and its full path.
 
- wurfl_last_load_time        Contains the UNIX timestamp of the last time
                              WURFL has been loaded successfully.
 
- wurfl_normalized_useragent  The normalized useragent.
 
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.

wurfl-information-list-separator

A char that will be used to separate values in a response header containing
WURFL results. If not set that a comma (',') will be used by default.
 
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.

wurfl-patch-file []

A list of WURFL patch file paths. Note that patches are loaded during startup
thus before the chroot.
 
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.

wurfl-cache-size

Sets the WURFL Useragent cache size. For faster lookups, already processed user
agents are kept in a LRU cache :
- "0"     : no cache is used.
- <size>  : size of lru cache in elements.
 
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.