Release Notes

The connection layer was optimized to reduce the number of syscalls.

Several debugging entries were added to help better spot anomalies.

Listeners have been reworked and related structures have been reorganized to better suit the new design. File descriptors are no longer manipulated by the listener layer.

TCP keepalive lets the Linux kernel know when a peer on the other end of a connection has stopped responding and that it's safe to close the idle connection. It discovers this by sending probes. If the peer doesn't reply, the socket is closed automatically.

You can change the number of probes to send, the interval at which to send them, or how long to wait before starting to send probes on both the client and server side through the following parameters:

A new section called log-forward can bind on TCP using the bind keyword and on UDP using dgram-bind for both IPv4 and IPv6.

You can thus create a syslog listener over UDP or TCP that can forward, prioritize, and translate syslog messages to a pool of UDP or TCP syslog servers.

When combined with the log sampling feature added in HAProxy Enterprise 2.0, you get granular control over how your syslog messages are forwarded.

You can also translate syslog messages from one format to another.

The Runtime API show info command also exposes a new counter called CumRecvLogs, which provides a global count of received syslog messages.

If you load SSL/TLS certificates separately from the certificate key through the ssl-load-extra-files global directive, the key no longer needs to be named the exact same as the certificate with .key appended to it.

The new global directive ssl-load-extra-del-ext instructs HAProxy Enterprise to remove the certificate file's extension before adding a new one.

For example, the key can be named mycert.key instead of mycert.crt.key.

The generate-certificates directive adds a Subject Alternative Name (SAN) to all generated certificates, which is a requirement in modern browsers. It now also supports chaining CAs and attaching a trust chain in addition to the generated certificate. The chain is loaded from the one provided in the ca-sign-file PEM file.

If the SNI is hardcoded on the server line using, as an example, sni str(example.local) there's no risk in reusing the connection. This release allows reusing connections that hardcode the SNI to the backend server. It will mark connections as private only if you've configured a variable expression for the SNI.

If a crt-list does not end with a new line, a warning indicates that the file might have been truncated.

The new show stat Runtime API command's option domain, allows you to change the context of the statistics. The proxy default value displays the core proxy statistics that were available before. The dns value displays statistics related to DNS resolution that HAProxy Enterprise performs.

The stats show-modules directive enables extra statistics related to HTTP/2 on the HAProxy Enterprise Stats.

The Stats page displays a new field under the Wght column, which previously only showed the live or effective weight. The Wght column now contains the effective weight separated with a "/" followed by the configured weight.

The show stat Runtime API command now allows you to use show stat up to filter on servers that are up or show stat no-maint to show those that are not in maintenance mode.

The Prometheus exporter received some new process and per-server metrics, as outlined here:

Metric	Description
haproxy_process_failed_resolutions	Total number of failed DNS resolutions.
haproxy_process_bytes_out_total	Total number of bytes emitted.
haproxy_process_spliced_bytes_out_total	Total number of bytes emitted through a kernel pipe.
haproxy_process_bytes_out_rate	Number of bytes emitted over the last elapsed second.
haproxy_server_unsafe_idle_connections_current	Current number of unsafe idle connections.
haproxy_server_safe_idle_connections_current	Current number of safe idle connections.
haproxy_server_used_connections_current	Current number of connections in use.
haproxy_server_need_connections_current	Estimated needed number of connections.

A typo has been fixed for the haproxy_process_frontend_ssl_reuse metric.

The Runtime API's show stat output has been extended and adds a new delimiter, a dash ("-"), after which additional dynamic fields can be added. Those fields won't be shown unless the relevant component is in use.