HAProxy

HAProxy's bare check keyword only opens a TCP connection to the server port. option httpchk makes the probe send an HTTP request instead, and http-check expect narrows success from any 2xx or 3xx reply to a specific status, regex or body string.

HAProxy evaluates use_backend rules top to bottom and the first one whose condition is true wins; if none match it uses default_backend. Space-separated ACL names in a condition are AND-ed, || is OR, and ! negates.

HAProxy adds Set-Cookie: SRVID=s1 to the first response so later requests carrying that cookie go back to s1. indirect strips the cookie before forwarding to the server and skips insertion when the client already sent a valid one; nocache marks the response private so shared caches cannot store it.

Declare a table storing http_req_rate(10s), track each request against it with http-request track-sc0 src, then deny with http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }. The track rule must come first, because the deny rule reads the counter that tracking populates.

HAProxy's Runtime API, exposed through a stats socket at admin level, accepts set server <backend>/<server> state drain to stop new sessions while existing ones finish. MAINT forces the server fully out and stops its health checks; DRAIN keeps checking and still honours persistence.

HAProxy keeps one in-memory entry per client IP recording which server that IP was sent to, and routes the same IP back to that server on later requests. After 30 minutes with no match the entry is purged and the balance algorithm chooses again.

In mode http HAProxy parses each request, so HTTP fetches, http-request rules and per-request balancing work. In mode tcp it relays bytes, balancing once per connection with only L4 and TLS-hello fetches. A frontend and the backends it uses must share the same mode or the config is rejected.

HAProxy's -sf means soft-finish: the new process takes over the listening sockets, then tells the listed old processes to stop accepting and finish their existing sessions before exiting. Runtime state, server health history and in-memory counters do not carry across.

In HAProxy, inter is the interval between probes, fall the number of consecutive failed checks that mark a server DOWN, and rise the consecutive successes that bring it back. Detection costs roughly fall times inter, which fastinter shortens once a check has already failed.

size is the maximum number of entries, expire the idle timeout per entry, and store the list of counters each entry carries, with the measurement window declared inside the counter. When the table is full HAProxy purges the oldest entries to make room, unless nopurge is set.

HAProxy opens its own connection to the server, so the source address is the proxy's. In HTTP mode option forwardfor adds the client address as a header; for TCP or TLS passthrough the PROXY protocol carries it, via send-proxy on the server line and accept-proxy on a receiving bind.

HAProxy's observe server keyword watches real traffic instead of probes: observe layer4 counts connection errors, observe layer7 also counts 5xx and malformed responses. error-limit sets how many errors trigger the on-error action, and active checks must be enabled for it to work.

Each node counts only the traffic it sees, so a client spread across both nodes gets roughly double the intended limit, and a client that moves nodes loses its stickiness. A peers section replicates table entries between nodes asynchronously, giving one shared view rather than two independent ones.

HAProxy holds the request in the backend's queue until a server slot frees, bounded by timeout queue, after which the client gets 503. Server-line maxconn caps concurrent connections to one server; global maxconn caps them for the whole process.

In HAProxy logs the first character says who or what ended the session and the second says which phase it was in. sH is a server-side timeout waiting for response headers, sQ a timeout in the queue, cD a client timeout during data transfer, and SC a server refusing or resetting the connection.

deny answers immediately with an error and frees the connection, tarpit holds the request for the tarpit timeout before answering and ties up a session slot meanwhile, and silent-drop discards the connection without telling the client, costing HAProxy least but leaving state on every device in between.