How To Analyze Logs On Aloha On A Pcode On A Linux Server On A Microsoft Powerbook (For Acedo) On A Macbook Or Ipad (For An Ubuntu) On An Ubode (For Macrocess



Similar documents
Native SSL support was implemented in HAProxy 1.5.x, which was released as a stable version in June 2014.

Device Integration: Citrix NetScaler

Device Integration: Cisco Wireless LAN Controller (WLC)

Collecting Windows logs using Snare

disect Systems Logging Snort alerts to Syslog and Splunk PRAVEEN DARSHANAM

Analyze Traffic with Monitoring Interfaces and Packet Forwarding

FILECLOUD HIGH AVAILABILITY

Volume SYSLOG JUNCTION. User s Guide. User s Guide

EventTracker Windows syslog User Guide

Snapt Balancer Manual

AlienVault Installation Guide

Spam Marshall SpamWall Step-by-Step Installation Guide for Exchange 5.5

Configuration Guide. Remote Backups How-To Guide. Overview

ALOHA LOAD BALANCER MANAGING SSL ON THE BACKEND & FRONTEND

Application Note. Failover through BGP route health injection

Syslog & xinetd. Stephen Pilon

Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.

ipta iptables Log Analyzer Anders Sikvall ichimusai.org

Using RADIUS Agent for Transparent User Identification

Configuring Microsoft IIS 5.0 With Pramati Server

File Transfer Examples. Running commands on other computers and transferring files between computers

Load Balancing Oracle Application Server (Oracle HTTP Server) Quick Reference Guide

CSE 265: System and Network Administration

PREDICTIVE DIALER AND REMOTE AGENT SETUP GUIDE

Configuring Security for FTP Traffic

How to install PowerChute Network Shutdown on VMware ESXi 3.5, 4.0 and 4.1

System Log Setup (RTA1025W Rev2)

Management, Logging and Troubleshooting

How to Make the Client IP Address Available to the Back-end Server

Configure Web Conference Parameters Through The Web Conference Administration User Interface.

How to Install Multicraft on a VPS or Dedicated Server (Ubuntu bit)

F-Secure Internet Gatekeeper

Configuring Apache HTTP Server as a Reverse Proxy Server for SAS 9.3 Web Applications Deployed on Oracle WebLogic Server

Load Balancing VMware Horizon View. Deployment Guide

Configuring SSL VPN on the Cisco ISA500 Security Appliance

Dell SupportAssist Version 2.0 for Dell OpenManage Essentials Quick Start Guide

Setting Up SSL on IIS6 for MEGA Advisor

MassTransit 6.0 Enterprise Web Configuration for Macintosh OS 10.5 Server

vrealize Operations Manager Load Balancing

Application Note. Active Directory Federation Services deployment guide

Central Administration QuickStart Guide

vcenter Operations Management Pack for SAP HANA Installation and Configuration Guide

Contents Set up Cassandra Cluster using Datastax Community Edition on Amazon EC2 Installing OpsCenter on Amazon AMI References Contact

Network Probe User Guide

Load Balancing VMware Horizon View. Deployment Guide

Syslog (Centralized Logging and Analysis) Jason Healy, Director of Networks and Systems

Tenrox and Microsoft Dynamics CRM Integration Guide

Deploy the ExtraHop Discover Appliance with Hyper-V

NetIQ Sentinel Quick Start Guide

Working with ESX(i) Log Files

ShadowControl ShadowStream

Online Backup Client User Manual

REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER

Configuring IBM HTTP Server as a Reverse Proxy Server for SAS 9.3 Web Applications Deployed on IBM WebSphere Application Server

AlienVault Unified Security Management (USM) 4.x-5.x. Deploying HIDS Agents to Linux Hosts

TECHNICAL REFERENCE. Version 1.0 August 2013

Security Correlation Server Quick Installation Guide

SECURE Web Gateway. HTTPS/SSL Technical FAQ. Version 1.1. Date 04/10/12

System Administration Guide

Proctor Caching User Guide

System Administration

Microsoft Lync 2010 Deployment Guide

Web Conferencing Version 8.3 Troubleshooting Guide

syslog - centralized logging

The data between TC Monitor and remote devices is exchanged using HTTP protocol. Monitored devices operate either as server or client mode.

Server configuration for layer 4 DSR mode

Net/FSE Installation Guide v1.0.1, 1/21/2008

Red Condor Syslog Server Configurations

WhatsUp Gold v16.3 Installation and Configuration Guide

Comtrend 1 Port Router Installation Guide CT-5072T

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

Overview. Author: Seth Scardefield Updated 11/11/2013

Best Practices in Hardening Apache Services under Linux

SysPatrol - Server Security Monitor

RSA Event Source Configuration Guide. F5 Big-IP Local Traffic Manager

Zend Server 5.0 Reference Manual

Network Monitoring & Management Log Management

SCOPTEL WITH ACTIVE DIRECTORY USER DOCUMENTATION

Monitoring System Status

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent?

nexvortex Setup Template

Load Balancing Microsoft Remote Desktop Services. Deployment Guide

Dell SonicWALL SRA 7.0 Geo IP & Botnet Filters

MultiSite Manager. User Guide

Load Balancing Trend Micro InterScan Web Gateway

EVS Broadcast Equipment S.A. Copyright All rights reserved.

Chapter 8 Monitoring and Logging

Enterprise Manager. Version 6.2. Installation Guide

Load Balancing Microsoft Terminal Services. Deployment Guide

Avaya IP Office SIP Trunk Configuration Guide

Remote Desktop Services Overview. Prerequisites. Additional References

Browser Client 2.0 Admin Guide

IBM WebSphere Application Server V8.5 lab Basic Liberty profile administration using the job manager

Name Services (DNS): This is Quick rule will enable the Domain Name Services on the firewall.

Online Backup Linux Client User Manual

Chapter 6 Virtual Private Networking Using SSL Connections

Knowledge Base Articles

CYAN SECURE WEB APPLIANCE. User interface manual

Syslog Configuration for Auditing

Transcription:

Application Note Analyze ALOHA s HAProxy logs with halog Document version: v1.1 Last update: 3rd September 2013

Purpose Being able to analyze logs generated by the ALOHA Load-Balancer stored in a third party syslog server. Complexity Versions concerned Aloha 4.2 and above Synopsis The ALOHA Load-Balancer, when used in layer 7 mode, generates very verbose log lines. It can store them in a circular buffer in memory. Unfortunately, the memory allocated to store the logs is limited and can only be used for instant troubleshooting. To analyze an issue which occured a few minutes ago, or to get tendances on server or application response time, it is not enough. To analyze logs, HAProxy comes with a small tool called halog that we can install and use on the server which stores the logs generated by the ALOHA. ALOHA remote syslog configuration In the WUI do the following, go in the Services tab, then click on the Edit icon syslog traffic line from the Add a line server in the configuration, like in the example below: server 192.168. 10.26: 514 Then click on the restart icon. The ALOHA Load-Balancer emits two types of logs: traffic log: connection log, very verbose. They are sent with local0 facility and info severity. Page 2 on 7

event log: events occurring on frontends, backends, servers, etc... They are sent with local0 facility and notice severity. We may want to log them differently in the file system because each type of log can be used for different purpose. Linux syslog server configuration syslog-ng Syslog-ng is one of the most powerful syslog server. For syslog-ng, you have to define a source, a filter and a destination, like in the example below: # tells syslog - ng to listen on its external IP source s_ net { udp ( ip (" 192. 1 68. 10. 26") port ( 514)); }; # where to write the logs # traffic logs destination d_aloha_traffic { file ("/ var / log / aloha / traffic. log " create_dirs ( yes )); }; # event logs destination d_aloha_events { file ("/ var / log / aloha / events. log " create_dirs ( yes )); }; # ALOHA traffic logs are emitted with facilty local0 and level info filter f_aloha_traffic { facility ( local0 ) and level ( info ); }; # ALOHA event logs are emitted with facilty local0 and level notice filter f_aloha_events { facility ( local0 ) and level ( notice ); }; # traffic logging log { source ( s_ net ); filter ( f_ aloha_ traffic ); destination ( d_aloha_traffic ); }; # events logging log { source ( s_ net ); filter ( f_ aloha_ events ); destination ( d_aloha_events ); }; rsyslog rsyslog is one of the most used syslog server, since it s installed by default on the main Linux distribution. For rsyslog, we have to enable the network socket and route ALOHA log lines too. In order to make rsyslog listen on the network, uncomment the two line below in the file /etc/rsyslog.conf: $ModLoad imudp $UDPServerRun 514 Page 3 on 7

In order to route syslog messages to different files, add the two line below to the end of the /etc/rsyslog.conf file: # ALOHA logs traffic with facility local0 and severity info local0. info -/ var / log / aloha / traffic. log # ALOHA logs events with facility local0 and severity notice local0. notice -/ var / log / aloha / events. log logrotate When adding new log files, it s a good idea to rotate them as well as to delete oldest files. This is the role of logrotate. Create a new file called aloha in logrotate s configuration directory /etc/logrotate.d: / var / log / aloha /*. log { rotate 31 daily missingok notifempty delaycompress compress sharedscripts postrotate invoke -rc.d rsyslog reload > / dev / null endscript } In the example above, replace rsyslog by syslog-ng, depending which syslog server you re running HALog installation HALog is a small and very powerful tool to analyze ALOHA s log lines. Installation is pretty simple, as described bellow: cd / usr / src wget http :// haproxy.1 wt.eu/ download /1.5/ src / devel / haproxy -1.5 - dev11. tar.gz tar xzf haproxy -1.5 - dev11. tar.gz cd haproxy -1.5 - dev11 / contrib / halog make cp halog / usr / bin / Analyzing ALOHA s logs Now we have ALOHA s log and halog in the same server we can run some analyze on them. Page 4 on 7

List servers by number of requests treated The command below lists the servers by the number of requests they treated. The server name is prefixed by the backend name. The eighth columns "tot_req" gives the number of requests treated by the server. cat traffic. log halog - srv -H -q awk NR ==1; NR > 1 { print $0 " sort -n -r -k 9"} column -t List servers by response time The command below lists the servers by response time. The server name is prefixed by the backend name. The response time is in milliseconds and the latest columns "avg_rt" gives the average response time for all the URLs forwarded to this server in this backend. cat traffic. log halog - srv -H -q awk NR ==1; NR > 1 { print $0 " sort -n -r -k 12"} column -t It is a best practice to split dynamic and static traffic: you would see the server response time for each type of traffic List servers by application errors: HTTP status code 5xx The command below lists the servers by number of application errors. The server name is prefixed by the backend name. The sixth column "5xx" gives the number of application errors generated by the server. cat traffic. log halog - srv -H -q awk NR ==1; NR > 1 { print $0 " sort -n -r -k 6"} column -t It is a best practice to split your applications per backend, that way you will see whose application generates errors on which server List servers by errors The command below lists the servers by number of errors not related to the application. The server name is prefixed by the backend name. cat traffic. log halog - srv -H -q awk NR ==1; NR > 1 { print $0 " sort -n -r -k 5"} column -t Page 5 on 7

List URLs by server computation time The command below lists the URLs by the average computation time, whatever the server which treated it. The sixth column "okavg" provides the URL average computation time in milliseconds. cat traffic. log halog - ut - H - q column - t 1004 0 6609819 6583 6609819 6583 /3 s. php 2006 0 2771766 1381 2771766 1381 / health. php 2008 0 1601026 797 1601026 797 / fast. php 1004 0 1003335 999 1003335 999 / mega. php 1004 0 406830 405 406830 405 / health. html List URLs by errors The command below lists the URLs by the number of errors they have generated, whatever the server which treated it or the type of error. The second column "err" provides the number of errors generated by the given URL (latest column). cat traffic. log halog - ue - H - q column - t 1004 0 1003335 999 1003335 999 / mega. php 2006 0 2771766 1381 2771766 1381 / health. php 1004 0 406830 405 406830 405 / health. html 2008 0 1601026 797 1601026 797 / fast. php 1004 0 6609819 6583 6609819 6583 /3 s. php List URLs by missing files: HTTP status code 404 The command below lists the URLs by the number of missing files error they have generated, whatever the server which treated it. The first column "req" provides the number of 404 returned for the given URL (latest column). cat traffic. log halog - u - H - q - hs 404 column - t List URLs by number of request The command below lists the URLs by the number of time they have been requested on the platform. The first column "req" provides the number of time the URLs was called. Page 6 on 7

cat aloha. log halog -u -H -q awk NR ==1; NR > 1 { print $0 " sort -n -r -k 1"} column -t 2008 0 1601026 797 1601026 797 / fast. php 2006 0 2771766 1381 2771766 1381 / health. php 1004 0 6609819 6583 6609819 6583 /3s. php 1004 0 406830 405 406830 405 / health. html 1004 0 1003335 999 1003335 999 / mega. php Page 7 on 7