The latest insights from the load balancing experts | Loadbalancer.org
  • Support
  • Blog
  • +1 833 274 2566
  • Solutions
  • Services
  • Products
  • Resources
  • Get Started
  • Support
  • Blog
Schedule your demo
  • Solutions
  • Services
  • Products
  • Resources
  • Get Started
  • Support
  • Blog

The latest insights from the load balancing experts | Loadbalancer.org

  • Latest posts
  • By topic
    • How Tos
    • Events
    • Guest Blogs
    • Top Ten Blogs
    • HA Proxy
  • By sector
    • Healthcare
    • Storage
    • Security
    • Print
    • Microsoft
  • How-To's
  • HAProxy
  • High Availability
  • Just for Fun
  • Security
  • Events
  • News
  • Amazon AWS
  • Linux
  • Healthcare
  • Top 10 Blogs
  • Reviews and Comparisons
  • SSL
  • Web Application Firewall (WAF)
  • Case Studies
  • Microsoft Azure
  • Disaster Recovery
  • Direct Server Return (DSR)
  • Microsoft Exchange
  • Global Server Load Balancing (GSLB)
  • Microsoft
  • Print
  • Denial of Service
  • Microsoft Remote Desktop Services
  • Web Filters / Proxy
  • Object Storage
  • Broadcast Media
  • X-Forwarded-For Header (XFF)
  • Guest Blogs
  • Google Cloud Platform (GCP)
  • VMware
  • Nutanix
  • open source
See more tags

How to write an external health check script for HAProxy

5 February 2019 / 4 min read / HAProxy

There's a saying you've probably heard: "Give a man a fish, and you feed him for a day. Teach a man to fish, and you feed him for a lifetime."

Health checks are an important part of load balancing your application, and in many other circumstances too. We are often asked to write custom checks, and of course we always go above and beyond to provide the most simple, most complete check we can come up with - no matter the application.

But if you can write your own custom health check for one of our appliances, that's an invaluable tool you can use time and time again. This blog is here to 'teach you to fish'.

Loadbalancer.org were the original sponsors of the external health check mechanism in HAproxy. We think it's an invaluable tool when you need something a bit special.

We also wanted to make sure that the external health check in HAProxy was compatible with the scripts used by Loadbalancer.org for layer 4 load balancing (LVS).

The actual commands to use in your HAProxy configuration file are pretty simple:

option external-check
external-check command /var/lib/loadbalancer.org/check/examplecheck

HAProxy will then execute this as a shell command and automatically present the variables the script requires for each backend server to be checked.

examplecheck 192.168.100.100 80 192.168.100.0 80 

The content of the variables passed to the script are as follows:

$1 = Virtual Service IP (VIP)
$2 = Virtual Service Port (VPT)
$3 = Real Server IP (RIP)
$4 = Real Server Port (RPT) 
$5 = Check Source IP 

Next we need to know what language we will be using for the health check. In this example I shall keep it simple and use bash.

You should use #!/bin/bash for portability. This is because different *nixes put bash in different places. You can use any scripting language that you are comfortable with.

What about the exit codes from the health check?

These are important, and there is a little bit of a difference between layer 4 and layer 7. Layer 7 expects a silent exit, and an exitcode of 0 as well as a PATH varible defined so it knows where the commands are. Layer 4 does not have this requirement and allows having text output to the console; however it does expect an exitcode of 0 for a passed healthcheck.

If you're using a Loadbalancer.org appliance then put the script in the correct location:

/var/lib/loadbalancer.org/check/

You can see a selection of the other scripts I have here:

check

Any scripts in this folder are automatically available via the web interface for both layer 4 and layer 7. Layer 4 has an extra check port option to allow for firewall marks and multi-port VIPs.

The layer 4 external health checks are available here:
l4externalcheck

Layer 7 does not require the check port as it automatically checks the first port listed within the VIP.
externalcheck

If you use a multi-port layer 7 VIP, the check string is different to the single port way.

Single port would start the check as below:

/var/lib/loadbalancer.org/check/examplecheck 172.31.1.99 80 172.31.1.100 80

However, the multi-port VIP check does not know the real server port and uses the first port in the VIP and is seen as below:

/var/lib/loadbalancer.org/check/examplecheck 172.31.1.99 80 172.31.1.100 0

Now we have all the information we need, let's start with an example health check that will work for both layer 4 and layer 7. This example will check something that we do not already provide as a built-in script.

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
VIP=$1
VPT=$2
RIP=$3
if [ "$4" eq "" ]; then   # check if $4 empty (Ie. a Multport VIP) 
    RPT=$VPT  # We are multiport - use the check port or VIP first port
else 
    RPT=$4
fi
    

Now we have the basis to start the check with we need to decide what check we should actually make.

CHECK_HOST="example.com"
CHECK_STRING="text to find"

# Build curl options variable
CURL_OPTS="--resolve ${CHECK_HOST}:${RPT}:${RIP}"

# Run curl with appropriate options
curl ${CURL_OPTS} -H 'Host: '${CHECK_HOST}'' -m 2 -k https://${CHECK_HOST}/${CHECK_PATH} 2>/dev/null | grep -q "${CHECK_STRING}"
exit $?

This will perform a curl SNI check against example.com.

Now when we put the entire check together it looks like this:

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
VIP=$1
VPT=$2
RIP=$3
if [ "$4" eq "" ]; then   # check if $4 empty (Ie. a Multport VIP) 
    RPT=$VPT  # We are multiport - use the check port or VIP first port
else 
    RPT=$4
fi

CHECK_HOST="example.com"
CHECK_STRING="text to find"

# Build curl options variable
CURL_OPTS="--resolve ${CHECK_HOST}:${RPT}:${RIP}"

# Run curl with appropriate options
curl ${CURL_OPTS} -H 'Host: '${CHECK_HOST}'' -m 2 -k https://${RIP}/${CHECK_PATH} 2>/dev/null | grep -q "${CHECK_STRING}"
exit $?

Don't forget the exit code!

You will see the last line is exit $?
This should present the exit code of 0 for a healthy server.
Any other number will cause a health check failure.

If you have any questions about the above, don't hesitate to get in touch.

Found in

HAProxy, How-To's

About the author

Andrew Smalley-profile-image
Andrew Smalley

Andrew first started working in Information Technology retail and support in 1989. His first experience of a modem was a 1200/75 baud, way back in 1984. He found Linux in the flavor of slackware on floppy disks and since then has used many distributions. His personal workstation choice now is Arch Linux and embedded distribution is Alpine Linux and he enjoys building and compiling for IOT and embedded devices. He contributes regularly to various mailing lists and to websites

Read More

Related posts

HAProxy
HAProxy
26 Aug 2020
Loadbalancer.org releases Open Source SNMP MIB and Agent for HAProxy Peter Statham
We’re always keen to give back to the community that writes such great software – our new SNMP agents and MIBs for HAProxy make monitoring your Virtual Services and Real Servers a breeze.

7 min read

Read more
Web Application Firewall (WAF)
Web Application Firewall (WAF)
31 Jul 2020
Secure connections: encrypt, inspect and decrypt traffic when using a WAF Neil Stone
Protect both web servers and users, with this combination of layers and tools.

4 min read

Read more
Microsoft Exchange
Microsoft Exchange
26 Feb 2019
Load Balancing Exchange 2016 Neil Hosking
Exchange 2016 is Microsoft's latest enterprise level messaging and collaboration server. It has been designed for simplicity of scale, hardware utilization, and failure isolation. This has greatly simplified both the deployment process and the implementation

4 min read

Read more

Get started

Get in touch

Start a conversation about the right solution for your business.

Get in touch

Create your quote

Transparent pricing you can see straight away.

Create your quote

Download now

Try us free for 30 days – see why our customers love us.

Download now

Schedule a virtual meeting with us

Working remotely or from home? Let’s meet on a call or online.

Let's meet

Follow Loadbalancer.org

+1 833 274 2566
  • Company
    • Solutions
    • Services
    • Load balancer
    • Why Loadbalancer.org
    • Blog
    • Professional services
    • Sitemap
  • Load balancer
    • Get a quote
    • Free trial
    • Online demo
  • Resources
    • Manuals
    • Deployment guides
    • Applications
    • White papers
    • Case studies
    • Solutions
  • Support
    • FAQ's
    • Open a ticket
    • Security news
  • Applications
    • Healthcare
    • Storage
    • Print
    • Security
    • Microsoft
The latest insights from the load balancing experts | Loadbalancer.org

The latest insights from the load balancing experts | Loadbalancer.org. All rights reserved

  • Contact Us
  • Terms & Conditions
  • Privacy Policy