On Thu, Oct 28, 2021 at 09:54:55AM -0700, Ryan Burn wrote: > On the size limit, ideally we'd like to capture up to the first 128k of the > body. But after doing some tests, it looks like we can only get up the first > 15k, even if we specify "http-response wait-for-body time 10s at-least > 128k". When you say the capture is limited by the buffer size, do you mean > this size > https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#3.2-tune.bufsize > ?
This is this one indeed. This is the largest amount of data that will be buffered in one direction for a stream, thus the largest amount of data you can process at once. If you want to analyse the first 128k, just increase it to that value. Be careful on the memory usage though, as all requests and responses will use such large buffers. This can use quite some memory on congested or lossy networks for example. But it's not extreme either, and I've already seen configs with up to 1 MB for some special cases. Willy
