[root@rocky8 ~]# haproxy -v HA-Proxy version 1.9.16 2020/07/31 - https://haproxy.org/ No more fixes for branch 1.9 past this version, please upgrade to branch 2.0!
[root@rocky8 ~]# haproxy -vv HA-Proxy version 1.9.16 2020/07/31 - https://haproxy.org/ No more fixes for branch 1.9 past this version, please upgrade to branch 2.0! Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-old-style-declaration -Wno-ignored-qualifiers -Wno-clobbered -Wno-missing-field-initializers -Wno-implicit-fallthrough -Wno-stringop-overflow -Wno-cast-function-type -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference OPTIONS = USE_ZLIB=1 USE_CPU_AFFINITY=1 USE_OPENSSL=1 USE_SYSTEMD=1 USE_PCRE=1
Built with OpenSSL version : OpenSSL 1.1.1k FIPS 25 Mar 2021 Running on OpenSSL version : OpenSSL 1.1.1k FIPS 25 Mar 2021 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Built with zlib version : 1.2.11 Running on zlib version : 1.2.11 Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip") Built with PCRE version : 8.42 2018-03-20 Running on PCRE version : 8.42 2018-03-20 PCRE library supports JIT : no (USE_PCRE_JIT not set) Encrypted password support via crypt(3): yes Built with multi-threading support.
Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll.
Available multiplexer protocols : (protocols marked as <default> cannot be specified using 'proto' keyword) h2 : mode=HTX side=FE|BE h2 : mode=HTTP side=FE <default> : mode=HTX side=FE|BE <default> : mode=TCP|HTTP side=FE|BE
#官网业务访问入口 listen WEB_PORT_80 bind 192.168.10.100:80 mode http option forwardfor server web1 10.0.0.17:8080 check inter 3000 fall 3 rise 5 server web2 10.0.0.27:8080 check inter 3000 fall 3 rise 5
backend web_http_nodes mode http option forwardfor server 10.0.0.17 10.0.0.17:8080 check inter 3000 fall 3 rise 5 server 10.0.0.27 10.0.0.27:8080 check inter 3000 fall 3 rise 5
# 创建子配置文件，注意：必须为cfg后缀非.开头的配置文件 [root@centos7 ~]# vim /etc/haproxy/conf.d/test.cfg listen WEB_PORT_80 bind 10.0.0.7:80 mode http balance roundrobin server web1 10.0.0.17:80 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 check inter 3000 fall 2 rise 5
#查看帮助 [root@rocky8 ~]# socat -h [root@rocky8 ~]# echo "help" | socat stdio /var/lib/haproxy/haproxy.sock Unknown command. Please enter one of the following commands only : help : this message prompt : toggle interactive mode with prompt quit : disconnect show tls-keys [id|*]: show tls keys references or dump tls ticket keys when id specified set ssl tls-key [id|keyfile] <tlskey>: set the next TLS key for the <id> or <keyfile> listener to <tlskey> show sess [id] : report the list of current sessions or dump this session shutdown session : kill a specific session shutdown sessions server : kill sessions on a server clear counters : clear max statistics counters (add 'all'for all counters) show info : report information about the running process [json|typed] show stat : report counters for each proxy and server [json|typed] show schema json : report schema used for stats disable agent : disable agent checks (use 'set server' instead) disable health : disable health checks (use 'set server' instead) disable server : disable a server for maintenance (use 'set server' instead) enable agent : enable agent checks (use 'set server' instead) enable health : enable health checks (use 'set server' instead) enable server : enable a disabled server (use 'set server' instead) set maxconn server : change a server's maxconn setting set server : change a server's state, weight or address get weight : report a server's current weight set weight : change a server's weight (deprecated) show resolvers [id]: dumps counters from all resolvers section and associated name servers clear table : remove an entry from a table set table [id] : update or create a table entry's data show table [id]: report table usage stats or dump this table's contents show peers [peers section]: dump some information about all the peers or this peers section disable frontend : temporarily disable specific frontend enable frontend : re-enable specific frontend set maxconn frontend : change a frontend's maxconn setting show servers state [id]: dump volatile server information (for backend <id>) show backend : list backends in the current running config shutdown frontend : stop a specific frontend set dynamic-cookie-key backend : change a backend secret key for dynamic cookies enable dynamic-cookie backend : enable dynamic cookies on a specific backend disable dynamic-cookie backend : disable dynamic cookies on a specific backend show errors : report last request and response errors for each proxy set maxconn global : change the per-process maxconn setting set rate-limit : change a rate limiting value set severity-output [none|number|string] : set presence of severity level in feedback information set timeout : change a timeout setting show env [var] : dump environment variables known to the process show cli sockets : dump list of cli sockets show cli level : display the level of the current CLI session show fd [num] : dump list of file descriptors in use show activity : show per-thread activity stats (for support/developers) operator : lower the level of the current CLI session to operator user : lower the level of the current CLI session to user show startup-logs : report logs emitted during HAProxy startup show cache : show cache status add acl : add acl entry clear acl <id> : clear the content of this acl del acl : delete acl entry get acl : report the patterns matching a sample for an ACL show acl [id] : report available acls or dump an acl's contents add map : add map entry clear map <id> : clear the content of this map del map : delete map entry get map : report the keys and values matching a sample for a map set map : modify map entry show map [id] : report available maps or dump a map's contents show pools : report information about the memory pools usage show profiling : show CPU profiling options set profiling : enable/disable CPU profiling [root@centos7 ~]# echo "get weight wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock 3 (initial 3) # 修改weight，注意只针对单进程有效 [root@centos7 ~]# echo "set weight wang-test-80/web2 2" | socat stdio /var/lib/haproxy/haproxy.sock [root@centos7 ~]# echo "get weight wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock 2 (initial 3) # 将后端服务器禁用，注意只针对单进程有效 [root@centos7 ~]# echo "disable server wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock # 启用后端服务器 [root@centos7 ~]# echo "enable server wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock # 将后端服务器软下线，即weight设为0 [root@centos7 ~]# echo "set weight wang-test-80/web1 0" | socat stdio /var/lib/haproxy/haproxy.sock # 针对haproxy的多进程,将后端服务器禁用 [root@centos7 ~]# vim /etc/haproxy/haproxy.cfg stats socket /var/lib/haproxy/haproxy1.sock mode 600 level admin process 1 #绑定第1个进程和socket文件 stats socket /var/lib/haproxy/haproxy2.sock mode 600 level admin process 2 #绑定第2个进程和socket文件 nbproc 2 [root@centos7 ~]# echo "disable server wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy1.sock [root@centos7 ~]# echo "disable server wang-test-80/web2" | socat stdio /var/lib/haproxy/haproxy2.sock [root@haproxy ~]# for i in {1..2}; do echo "set weight wang-test-80/web$i 10" | socat stdio /var/lib/haproxy/haproxy$i.sock; done 3311987957 # 如果静态算法，如:static-rr，可以更改weight为0或1，但不支持动态更改weight为其它值，否则会提示下面信息 [root@centos7 ~]# echo "set weight wang-test-80/web1 0" | socat stdio /var/lib/haproxy/haproxy.sock [root@centos7 ~]# echo "set weight wang-test-80/web1 1" | socat stdio /var/lib/haproxy/haproxy.sock [root@centos7 ~]# echo "set weight wang-test-80/web1 2" | socat stdio /var/lib/haproxy/haproxy.sock Backend is using a static LB algorithm and only accepts weights '0%' and '100%'. # 新的写法 # 相当于disable server [root@ubuntu2004 ~]# echo "set server www.wang.org_nginx/web1 state maint" | socat stdio /var/lib/haproxy/haproxy.sock # 相当于enable server [root@ubuntu2004 ~]# echo "set server www.wang.org_nginx/web1 state ready" | socat stdio /var/lib/haproxy/haproxy.sock [root@ubuntu2004 ~]# echo "set server www.wang.org_nginx/web1 state drain" | socat stdio /var/lib/haproxy/haproxy.sock
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance static-rr server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 2 check inter 3000 fall 2 rise 5
[root@haproxy ~]# echo "set weight www.wang.org_nginx/10.0.0.101 1" | socat stdio /var/lib/haproxy/haproxy.sock Backend is using a static LB algorithm and only accepts weights '0%' and '100%'.
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance first server web1 10.0.0.17:80 maxconn 2 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
roundrobin: 基于权重的轮询动态调度算法，支持权重的运行时调整，不同于 LVS 中的 rr 轮询模式，HAProxy 中的 roundrobin 支持慢启动（新加的服务器会逐渐增加转发数），其每个后端 backend 中最多支持 4095 个 real server，支持对 real server 权重动态调整，roundrobin 为默认调度算法，此算法使用广泛。
1 2 3 4 5 6 7
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance roundrobin server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 2 check inter 3000 fall 2 rise 5
leastconn: 加权的最少连接的动态，支持权重的运行时调整和慢启动，即根据当前连接最少的后端服务器而非权重进行优先调度（新客户端连接），比较适合长连接的场景使用，比如 MySQL 等场景。
相当于LVS中的WLC算法
1 2 3 4 5 6 7
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance leastconn server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
random 算法
在1.9版本开始增加 random 的负载平衡算法，其基于随机数作为一致性 hash 的 key。随机负载平衡对于大型服务器场或经常添加或删除服务器非常有用，支持 weight 的动态调整，weight 较大的主机有更大概率获取新请求。
random配置实例
1 2 3 4 5 6 7
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance random server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
其他算法
其它算法即可作为静态算法，又可以通过选项成为动态算法。
source 算法
源地址 hash，基于用户源地址 hash 并将请求转发到后端服务器，后续同一个源地址请求将被转发至同一个后端 web 服务器。此方式当后端服务器数据量发生变化时，会导致很多用户的请求转发至新的后端服务器，默认为静态方式，但是可以通过 hash-type 选项进行更改。
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode tcp log global balance source hash-type map-based server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 3 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 3
#不支持动态调整权重值 [root@haproxy ~]# echo "set weight web_host/10.0.0.27 10" | socat stdio /var/lib/haproxy/haproxy.sock Backend is using a static LB algorithm and only accepts weights '0%' and '100%'.
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance uri server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
uri 一致性 hash 配置示例
1 2 3 4 5 6 7 8
listen web_host bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010 mode http log global balance uri hash-type consistent server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
#listen配置 listen web_host bind 10.0.0.7:80 mode http #一定是http模式,tcp 模式不会传递客户端IP log global balance random server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5 server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5
Feb 2 18:49:27 centos7 journal: Runtime journal is using 6.0M (max allowed 48.6M, trying to leave 72.9M free of 480.1M available -> current limit 48.6M). Feb 2 18:49:27 centos7 kernel: Initializing cgroup subsys cpuset Feb 2 18:49:27 centos7 kernel: Initializing cgroup subsys cpu Feb 2 18:49:27 centos7 kernel: Initializing cgroup subsys cpuacct ......
后端服务器健康性监测
三种状态监测方式
1 2 3
基于四层的传输端口做状态监测，此为默认方式 基于指定 URI 做状态监测，需要访问整个页面资源，占用更多带宽 基于指定 URI 的 request 请求头部内容做状态监测，占用较少带宽，建议使用此方式
#关于HTTP/1.1的说明 <version> is the optional HTTP version string. It defaults to "HTTP/1.0" but some servers might behave incorrectly in HTTP 1.0, so turning it to HTTP/1.1 may sometimes help. Note that the Host field is mandatory in HTTP/1.1, and as a trick, it is possible to pass it after "\r\n" following the version string.
访问控制列表（ACL, Access Control Lists）是一种基于包过滤的访问控制技术，它可以根据设定的条件对经过服务器传输的数据包进行过滤（条件匹配），即对接收到的报文进行匹配和过滤。基于请求报文头部中的源地址、源端口、目标地址、目标端口、请求方法、URL、文件后缀等信息内容进行匹配并执行进一步操作，比如允许其通过或丢弃。
#有些功能是类似的，比如以下几个都是匹配用户请求报文中host的开头是不是www acl short_form hdr_beg(host) www. acl alternate1 hdr_beg(host) -m beg www. acl alternate2 hdr_dom(host) -m beg www. acl alternate3 hdr(host) -m beg www.
base : string #返回第一个主机头和请求的路径部分的连接，该请求从主机名开始，并在问号之前结束，对虚拟主机有用，下面的例子中是两个#中间的内容，实际#是没有的 <scheme>://<user>:<password>@<host>:<port>/<path>; <params>#?<query>#<frag> base : exact string match base_beg : prefix match base_dir : subdir match base_dom : domain match base_end : suffix match base_len : length match base_reg : regex match base_sub : substring match
path : string #提取请求的URL路径，该路径从第一个斜杠开始，并在问号之前结束（无主机部分） <scheme>://<user>:<password>@<host>:<port>/<path>; <params>#?<query>#<frag> path : exact string match path_beg : prefix match #请求的URL开头，如/static/, /images/, /img/, /css path_end : suffix match #请求的URL中资源的结尾，如 .gif, .png, .css, .js, .jpg, .jpeg path_dom : domain match path_dir : subdir match path_len : length match
#在后端服务器安装和配置 MariaDB 服务 [root@centos7 ~]# yum -y install mariadb-server [root@centos7 ~]# mysql -e "grant all on *.* to test@'10.0.0.%' identified by '123456'" [root@centos7 ~]# vim /etc/my.cnf [mysqld] server-id=17 # 在另一台主机为27
[root@centos7 ~]# systemctl start mariadb
#测试 [root@centos6 ~]# mysql -utest -p123456 -e "show variables like 'hostname'" +-----------------+--------------------------------------+ | Variable_name | Value | +-----------------+--------------------------------------+ | hostname | centos17.wangxiaochu.com | +-----------------+--------------------------------------+
[root@centos6 ~]# mysql -utest -p123456 -e "show variables like 'hostname'" +-----------------+--------------------------------------+ | Variable_name | Value | +-----------------+--------------------------------------+ | hostname | centos27.wangxiaochu.com | +-----------------+--------------------------------------+
