HAProxy metrics are useful only when the stats path is understood
HAProxy metrics are useful only when the stats path is understood
HAProxy metrics are useful only when the stats path is understood. The HAProxy exporter reads HAProxy statistics and exposes them for Prometheus. Port 9101 is a common default. A scan of that port finds a large mixed population, so a count cannot be treated as an HAProxy exporter inventory without a response check.
只有理解了统计路径，HAProxy 指标才有用。HAProxy 导出器（exporter）读取 HAProxy 统计信息并将其暴露给 Prometheus。9101 端口是一个常见的默认端口。对该端口进行扫描会发现大量混合的设备，因此在没有进行响应检查的情况下，不能将统计数量视为 HAProxy 导出器的清单。
The measurements: The queries on November 5, 2026 used sub_type=all and returned: Query Matches UTC time port=“9101” 1,410,440 2026-11-05T00:40:53Z app=“haproxy_exporter” 0 2026-11-05T00:40:55Z http.body=“haproxy_exporter_build_info” 2 2026-11-05T00:40:56Z. The port count is not a plausible count of HAProxy exporters. 9101 is used by many unrelated services and devices. The application fingerprint returned nothing, and the two build-information body matches are a much narrower signal that still needs a live verification.
测量结果：2026 年 11 月 5 日的查询使用了 sub_type=all，返回结果为：端口 “9101” 匹配 1,410,440 次（UTC 时间 2026-11-05T00:40:53Z），应用 “haproxy_exporter” 匹配 0 次（UTC 时间 2026-11-05T00:40:55Z），http 正文 “haproxy_exporter_build_info” 匹配 2 次（UTC 时间 2026-11-05T00:40:56Z）。该端口计数并非 HAProxy 导出器的合理数量。9101 端口被许多无关的服务和设备使用。应用指纹未返回任何结果，而两个构建信息正文匹配是一个非常窄的信号，仍需进行实时验证。
The stats endpoint is the real dependency: The exporter connects to HAProxy’s stats interface, which can be a web endpoint or a stats socket depending on configuration. That interface contains frontend, backend, server, health, and traffic data. It may require credentials or a restricted source address. Protect the stats connection independently from the exporter’s Prometheus listener. A public exporter is a disclosure risk, while a public HAProxy stats page can expose backend names and server states even without the exporter. Review both paths.
统计端点是真正的依赖项：导出器连接到 HAProxy 的统计接口，该接口根据配置可以是 Web 端点或统计套接字。该接口包含前端、后端、服务器、健康状况和流量数据。它可能需要凭据或受限的源地址。请将统计连接与导出器的 Prometheus 监听器分开保护。公开的导出器存在泄露风险，而公开的 HAProxy 统计页面即使没有导出器，也可能暴露后端名称和服务器状态。请检查这两条路径。
The exporter’s scrape URI may contain a username and password. Keep the URI in a protected file or secret store. Do not print it in deployment logs or pass it through a shell history. Prefer a dedicated HAProxy stats user with read-only access.
导出器的抓取 URI 可能包含用户名和密码。请将该 URI 保存在受保护的文件或密钥存储中。不要将其打印在部署日志中，也不要通过 shell 历史记录传递。建议使用具有只读访问权限的专用 HAProxy 统计用户。
Separate the proxy from the collector: An HAProxy process can be an internet-facing load balancer while its exporter remains on a management network. Do not assume the exporter shares the proxy’s exposure. Compare the listener addresses, firewall rules, and route tables for both processes. A public port 9101 could be a different service with a misleading number. Verify the HTTP response and the deployed process before treating the address as an exporter. The response should identify the exporter’s expected metric names, and the host inventory should show the package and service unit.
将代理与收集器分离：HAProxy 进程可以是面向互联网的负载均衡器，而其导出器则保留在管理网络上。不要假设导出器与代理具有相同的暴露程度。比较两个进程的监听地址、防火墙规则和路由表。公共的 9101 端口可能是另一个具有误导性编号的服务。在将该地址视为导出器之前，请验证 HTTP 响应和已部署的进程。响应应标识导出器预期的指标名称，主机清单应显示软件包和服务单元。
Monitoring and change control: Track the exporter version, build information, scrape URI source, and HAProxy configuration version together. A backend name change can alter metric labels and dashboards, while a credential change can silently turn the collector into a failing check. Treat both as monitored changes. Use a bounded scrape timeout and avoid returning unbounded labels from proxy statistics. A malicious or misconfigured backend name can increase metric cardinality. Keep external input out of label values where the exporter supports normalization.
监控与变更控制：共同跟踪导出器版本、构建信息、抓取 URI 源和 HAProxy 配置版本。后端名称的更改可能会改变指标标签和仪表板，而凭据的更改可能会使收集器在静默状态下失效。将两者都视为受监控的变更。使用有限的抓取超时，并避免从代理统计信息中返回无限的标签。恶意或配置错误的后端名称会增加指标的基数。在导出器支持标准化的位置，请勿将外部输入放入标签值中。
Review the two-match result: The two body matches are candidate pages, not two confirmed exporters. An owner should check each match from the monitoring network, inspect the endpoint’s response, and compare the result with the Prometheus target inventory. The huge port count should not be used as the denominator for a risk percentage. The effective control is simple: HAProxy stats reachable only by the exporter, exporter reachable only by Prometheus, and the credential scoped to read-only statistics. The counts tell us where to search, not whether that control holds.
审查两个匹配结果：这两个正文匹配项是候选页面，而非两个已确认的导出器。所有者应从监控网络检查每个匹配项，检查端点的响应，并将结果与 Prometheus 目标清单进行比较。巨大的端口计数不应作为风险百分比的分母。有效的控制很简单：HAProxy 统计信息仅能由导出器访问，导出器仅能由 Prometheus 访问，且凭据仅限于只读统计信息。这些计数告诉我们去哪里搜索，而不是该控制是否有效。