Skip to content

SigSci Haproxy SPOE module troubleshooting guide

Introduction

SigSci Haproxy SPOE module is different from other modules. Haproxy can be configured to send HTTP traffic to an external service using SPOP protocol. Haproxy ACL can be used to block or redirect the request based on the external service response. SigSci agent can be configured as an external service to receive HTTP traffic from Haproxy using SPOP protocol. This troubleshooting guide is helpful to support engineers for diagnosing Haproxy SPOE configuration issues as reported by the customers.

Haproxy versions supported

Haproxy v1.8, v2.0, v2.2 and v2.4 can be configured to send HTTP traffic to SigSci agent.

Verify the Haproxy SPOE configuration

  • Verify that the customer installed the latest version of the SigSci agent and Haproxy module

  • Verify that agent is listening for SPOP connections and the socket file /var/run/sigsci-ha.sock exists

sigsci.conf

    haproxy-spoa-enabled=true
  • Verify that SPOE filter configured in each frontend section. Haproxy v1.8,v2.0 should use sigsci-1.8.conf and Haproxy v2.2,v2.4 should use sigsci-2.2.conf

haproxy.cfg

    frontend http-in
      mode http
      option http-buffer-request

      filter spoe engine sigsci config /opt/signalsciences/haproxy-spoe/sigsci-2.2.conf

Agent online but module isn't registered or undetected

  • If Haproxy global configuration contains chroot <path>, sigsci agent backend address should be set to /sigsci-ha.sock in haproxy.cfg and agent's rpc-address should be set to <path>/sigsci-ha.sock

haproxy.cfg

    global
      chroot /var/lib/haproxy

    backend sigsci-agent
      server agent unix@/sigsci-ha.sock

sigsci.conf

    haproxy-spoa-enabled=true
    haproxy-spoa-address=/var/lib/haproxy/sigsci-ha.sock

Request data not uploaded to the cloud or requests not found

Review the http-request action ACLs in Haproxy configuration

http-request deny and http-request redirect location ACLs not using variable in namespace txn.waf.* prevent the SPOE calling updateRequest or postRequest. There is no fix available at this time.

Known issues

All Haproxy versions

  • Haproxy limits the POST body buffer size to 16K. So Haproxy may send partial POST body to SigSci agent.

    Buffer request
    Tune bufsize
    [ML msg] (https://www.mail-archive.com/haproxy@formilux.org/msg23074.html)

Haproxy v1.8 and v2.2

  • Requests uploaded to SigSci cloud don't have response headers.

Escalating issues to engineering.

Add the output of the following commands to the JIRA ticket along with haproxy.cfg file

$haproxy -vv
$uname -a
$cat /etc/os-release