By default, HAProxy is configured to log events to the systems deamon, which typically means the journalctl command (on Linux) would be used to view the HAProxy events. If you instead would like to have HAProxy log events to it's own log file, you will first need to determine the system logger being used. 

The ps command can be used to determine if your system is using syslogd, rsyslogd or syslog-ng. In this example, rsyslogd is being used.

~]# ps -ef | grep -i syslog | grep -v grep
root      1287     1  0 Aug17 ?        00:13:30 /usr/sbin/rsyslogd -n

If rsyslog is being used, then you would create a file in the /etc/rsyslog.d directory.

touch /etc/rsyslog.d/haproxy.conf

And append the following to /etc/rsyslog.d/haproxy.conf.

local2.*  /var/log/haproxy.log

Then you would add the following to /etc/rsyslog.conf.

$ModLoad imudp
$UDPServerRun 514
$UDPServerAddress 127.0.0.1

And restart the rsyslog daemon for this change to take effect.

systemctl restart rsyslog

Now, the /var/log/haproxy.log should exists and contain HAProxy events.

Log Level & Log Format

By default, events will be logged at log level INFO. If you have requests that are being load balanced to a cluster of web servers, the httplog, http-request and log-format directives can be used to control the log level and log format of the events that get appended to /var/log/haproxy.log. Here is an example of how you could use the httplog, http-request and log-format directives in a frontend block.

• %ci logs the client IP address
• %cp logs the client port
• %b is the name of the backend that was requested
• %hr logs request headers
• %hs logs response headers
• %r logs HTTP requests (e.g. GET /index.html HTTP/1.1)
• %CC cookie request (e.g. my_cookie=foo)
• %CS cookie response
• %ST is the HTTP response code (e.g. 200 OK or 404 Not Found or 500 Internal Server Error)
• %s is the server name in the backend

frontend main
    bind *:80
    balance roundrobin
    option httplog
    http-request capture req.hdrs len 1024
    log-format %[date,utime(%Y%m%d%H%M%S)]\ %ci:%cp\ %b\ %hr\ %hs\ %r\ %CC\ %CS\ %ST\ %s

Something like this should be logged.

Jul 23 05:07:07 localhost haproxy[177757]: 1721711227 47.128.33.113:55328 www GET https://www.example.com/images/foo.jpg HTTP/2.0 sticky=server1 - server1