Hi Scott, On Thu, Sep 27, 2012 at 08:21:38AM -0700, Scott Francis wrote: > > Have you had a look at the request haproxy is receiving ? It would be > > nice to know whether it already receives multiple headers (eg: due to > > other components in the chain before it) or all of them at once. > > upstream -> haproxy -> Apache > > I can see in the apache logs the chain of 3-4 IPs in the XFF header, > and when I run tcpdump on an haproxy host I can also see multiple IPs > in the XFF there - they just aren't being emitted by haproxy to the > logs. (but the entire header, including all IPs, is being properly > passed along to the backend Apache instances).
OK but is there always only one XFF header when this happens or do you notice a second XFF header ? The difference is important, not from an HTTP point of view but due to how the captures work in haproxy, since they take a full header line only. What I suspect is that you have one XFF header with 3-4 IPs and another header with a single IP which gets logged. > (unrelated: the haproxy mailing list archives appear to have stopped > updating in late 2011; Yes I know, I need to disable them. They're unreliable, they consume a lot of space on the server and are not really used since gmane.org and marc.info are the default ones for many readers. > a quick Google search didn't turn up any > information about this, but I'm sure the question has been asked > before - when should we see current discussion threads appear in the > list archives? I'd like to be able to reference URLs for this thread > in discussions with co-workers.) The archives you'd better use are the following ones : http://marc.info/?l=haproxy http://blog.gmane.org/gmane.comp.web.haproxy I tend to prefer marc.info but it's a matter of taste. Oh and yes, I should update the link on the haproxy site :-) Willy
