iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with evidence, not a timeout change. Validate the configuration that the service actually loads, confirm that the HAProxy service is running, read its access and error logs, inspect backend health, and test each network leg directly from the HAProxy host. A 503, 502, 504, refused connection, or TLS handshake failure identifies a different failure stage; the status code alone is not a complete diagnosis.
The commands below use common Linux paths and systemd names. Package layouts, service-unit arguments, log destinations, and Runtime API features vary by distribution and HAProxy build, so verify the unit file and installed documentation before applying a command in production.
Recommended Free Tools
First response: establish what is running
Do not edit ACLs, backends, or timeout values until you know which binary and configuration are active. A syntactically valid file can still point to an unreachable server, select the wrong backend, fail a health check, or negotiate an incompatible TLS session.
1. Identify the installed build
- Run
haproxy -vvand record the version, build options, linked OpenSSL version, and enabled features. - Use the distribution package manager to identify the package that owns the binary and service. Community and Enterprise packages may use different unit files, chroot settings, sockets, or configuration locations.
- Inspect the service unit to find the exact
-fconfiguration path and any additional command-line options. The file at/etc/haproxy/haproxy.cfgis a common example, not a guarantee.
2. Check syntax on the exact file
Run the installed binary against the path used by the service:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
sudo haproxy -c -f /etc/haproxy/haproxy.cfgAdjust the path if the unit file uses another location. Debian’s haproxy(1) documentation defines -c as configuration-check mode: exit status 0 means no syntax error was found, while exit status 1 means a syntax error was found. A successful check proves only that HAProxy can parse the file; it does not prove that a backend is reachable, a health check is correct, a certificate is valid, or an application will answer.
3. Confirm service state and startup failures
sudo systemctl status haproxy
sudo journalctl -u haproxy --since "30 minutes ago"Look for bind failures, permission errors, missing certificate files, failed reloads, port conflicts, chroot problems, and configuration paths that differ from the one you tested. If the service is stopped, a client may see a refused connection before any frontend rule is evaluated.
Collect logs and a reproducible symptom
HAProxy’s request log, error log, health-check messages, and termination information usually narrow the fault faster than changing settings. Capture one failing request with its timestamp and preserve the original hostname, path, method, and headers.
Find the actual log destination
Check the global configuration for log directives and determine whether messages go to /dev/log, rsyslog, journald, or a distribution-specific file. A chrooted HAProxy process cannot automatically use the host’s normal socket: Debian’s man page warns that it sends logs over UDP and that the syslog daemon must listen on the relevant socket inside the chroot arrangement. Confirm the receiver before concluding that HAProxy is producing no logs.
Increase useful detail temporarily
For a short diagnostic window, increase request/response log detail for failed requests according to the logging options supported by your build. Enable option log-health-checks when servers are moving between up and down states and you need to see each transition. Remove or reduce temporary verbosity after the incident to avoid unnecessary log volume.
For every failure, record:
- Timestamp, frontend, backend, and selected server.
- HTTP status and HAProxy termination state.
- Queue, connect, and response timing fields available in your log format.
- Whether the request reached HAProxy’s listener and whether a direct request to the backend succeeds.
Read termination state before guessing
The termination state and timing fields distinguish a connection that never opened, a server that closed early, an invalid response, a queue that waited too long, and a response timeout. Field letters and meanings depend on the log format and version, so use the documentation for the installed build rather than copying an interpretation from an unrelated version.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
What the common status codes actually mean
| Symptom | HAProxy’s documented meaning | Most useful first evidence |
|---|---|---|
| 503 Service Unavailable | No server was available to handle the request. It can also result when no use_backend or default_backend rule matches. |
Backend health, stats or Runtime API, routing rules, and LastChk reason. |
| 502 Bad Gateway | The server returned an empty, invalid, or incomplete response, or an HTTP response rule denied it. | Direct backend curl -v, termination state, response framing, and application logs. |
| 504 Gateway Timeout | The response timeout expired before the server responded. | Timing phase in the access log, queue/connect/server timeout settings, and a direct request from the HAProxy host. |
| Connection refused | The intended listener or backend port actively rejected the TCP connection. | Service state, bind address and port, listener ownership, and a port test from the correct host. |
These meanings identify the failing stage, not the final fix. Continue with the branch that matches the evidence.
Connection refused or an unreachable listener
A refusal at the client side commonly means HAProxy is stopped, listening on a different address or port, or the client reached a different machine than expected. The same symptom can occur on the HAProxy-to-backend leg when the application is not listening.
- Check the service with
systemctl status haproxyand inspect recent journal entries for bind or startup errors. - List listening sockets and owning processes:
sudo ss -lntp- Compare the configured
bindaddress and port with the socket list. Check for another process occupying the port, an IPv4/IPv6 mismatch, or a bind address that is absent from the host. - From the HAProxy machine, test the backend address and port:
nc -vz BACKEND_HOST BACKEND_PORTUse the real address and port, and repeat the test for each server in the backend. A successful TCP connection does not prove that the HTTP protocol, Host header, TLS mode, or application route is correct.
Diagnosing 503 Service Unavailable
A 503 means HAProxy had no available server for that request, or the frontend did not select a backend. The first task is to separate an all-servers-down condition from a routing condition.
When every server is down
Open the statistics page or query the Runtime API if your build exposes one. A backend whose servers are all red or down points to reachability or health-check failure. Inspect each server’s LastChk reason and search logs for messages such as is DOWN or a 503 generated for the backend.
Test the exact check from the HAProxy host, not from your workstation. Verify all of the following:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Health-check address and port, including any separate check port.
- HTTP path, method, and expected status or response body.
- Host header and any required authentication or routing header.
- Whether the check uses plain HTTP or TLS, and whether SNI is sent.
- Firewall, security-group, network-policy, and local listener access.
- Application readiness: a process may accept connections while its dependency checks still fail.
Active checks connect or send requests at intervals. Enough consecutive failures remove a server from rotation; enough consecutive successes restore it. Therefore, a brief deployment or dependency outage can cause a temporary 503, while a deterministic path or protocol mismatch keeps the server down.
When no backend rule matches
If logs show a backend name that matches the frontend name, inspect use_backend ACL ordering and conditions. Requests that match no rule need an intentional default_backend if they should be served. Without a matching selection rule, HAProxy can return 503 even when every configured application server is healthy.
Do not “fix” 503 by disabling checks
Health checks exist so that only healthy servers remain in load-balancing rotation. Correct the check’s port, path, headers, TLS settings, or readiness endpoint. Disabling checks hides the failure and sends production traffic to a server that the configured test already found unusable.
Diagnosing 502 Bad Gateway
A 502 is a response-protocol or policy problem, not simply a slow request. HAProxy documents it when a server response is empty, invalid, or incomplete, and also when an http-response deny rule blocks the response.
Compare direct and proxied requests
From the HAProxy host, issue a direct request that preserves the production protocol and relevant headers:
curl -v http://BACKEND_HOST:BACKEND_PORT/PATHFor a TLS backend, use the backend’s HTTPS URL and the correct hostname. Compare the direct response with the request sent through the frontend. Check whether HAProxy is speaking HTTP to an HTTPS port or HTTPS to a plain HTTP port, whether the backend requires a particular Host header, and whether SNI or ALPN affects virtual-host selection.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Look for premature closes and malformed framing
Use the access-log termination state and timing fields to distinguish a server abort, an empty response, incomplete headers or body, and a policy denial. Correlate the timestamp with application logs for crashes, worker restarts, upstream failures, and response-generation errors. Verify that the server sends valid status and header lines and closes or frames the body consistently. Fix the application or protocol mismatch before increasing timeouts; a malformed response will remain malformed no matter how long HAProxy waits.
Diagnosing 504 Gateway Timeout
HAProxy emits 504 when its response timeout expires before the server responds. Determine which phase consumed the time before changing any timeout.
Use timing fields to find the waiting phase
Inspect queue, connection, and server-response timing fields in the access log. A long queue points to capacity or connection limits; a long connect phase points to network reachability or a saturated listener; a long server phase points to application latency or a backend dependency. The exact field layout depends on your configured log format.
Reproduce from the proxy host
Run a direct curl -v with the same path, method, Host header, authentication headers, and protocol. If the direct request is also slow, investigate the application and its dependencies. If it is fast while the proxied request times out, compare TLS negotiation, SNI, ALPN, request headers, connection reuse, and any queueing in HAProxy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review limits only after locating the phase
Check timeout connect, timeout client, timeout server, queue limits, and connection limits such as maxconn. Do not raise every timeout as a blanket remedy. A larger value can increase concurrent resource consumption and delay failure detection without repairing a blocked application, firewall, protocol mismatch, or saturated queue.
Connection timeouts and capacity limits
A timeout while opening a connection differs from a response timeout. Test each leg separately and preserve the production hostname when virtual hosting or TLS is involved.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Use
ss -lntpto verify local listeners and inspect socket pressure. - Use
nc -vzfrom the HAProxy host to test each backend port. - Use
curl -vto test the application protocol after TCP succeeds. - Check host firewalls, cloud security groups, routing tables, and network policies between HAProxy and the server.
- Review
maxconn, listener saturation, backend queueing, and file-descriptor or process limits exposed by your service configuration.
The official troubleshooting guidance lists connection limits, firewall rules, and backend reachability as common timeout causes. Confirm the constrained resource with logs and operating-system metrics before changing a global limit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting TLS handshake failures
Handshake failures occur either on the client-to-HAProxy leg, where HAProxy terminates TLS, or on the HAProxy-to-backend leg, where HAProxy establishes TLS upstream. The logs must tell you which leg failed.
Read the specific TLS error
Search HAProxy logs for SSL handshake failure, SSL DH error, and NO_SHARED_CIPHER. These messages indicate different compatibility or certificate problems. On supported HAProxy versions, add %[ssl_fc_err] and %[ssl_fc_err_str] to an error-log format to capture OpenSSL’s numeric error code and text for frontend handshakes.
Reproduce the client-facing handshake
openssl s_client -connect HOST:443 -servername NAMEUse the public hostname as NAME; omitting SNI can select a different certificate or virtual server. Inspect the certificate chain, selected protocol, cipher, and verification errors. Where appropriate, a TLS diagnostic tool such as testssl can enumerate protocol and cipher compatibility, but interpret its output against the policy you intend to enforce.
Check the upstream TLS leg
If HAProxy terminates client TLS and then uses TLS to a backend, test that backend endpoint with the correct SNI and certificate expectations. Confirm that the backend certificate chain is trusted as configured, the hostname matches the certificate, and both sides offer at least one compatible protocol and cipher. If HAProxy passes TLS through instead of terminating it, diagnose the handshake between the client and the application directly.
Preserve certificate verification and modern protocol policy. Do not use verify none, broadly weaken ciphers, or downgrade protocols as a default fix; first identify the certificate, SNI, protocol, or cipher mismatch.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUse health status as a timeline, not just a color
A red server indicator tells you the result, while LastChk, check logs, and transition timestamps explain why it changed. Enable option log-health-checks during intermittent incidents and correlate each down/up transition with deployments, firewall changes, certificate renewals, and dependency outages.
Validate the check independently with the same destination, port, path, method, headers, TLS mode, and SNI that HAProxy uses. An endpoint that returns 200 to a browser may return a redirect, authentication error, or dependency failure to the check because the Host header or path differs. Conversely, an endpoint can pass a shallow TCP check while the application is not ready to serve real requests.
A practical decision path
| Observed evidence | Next action | Scope of a likely correction |
|---|---|---|
| Configuration check fails | Fix the reported syntax, file path, permissions, or referenced file, then rerun the check. | Configuration file or service startup. |
| Service is inactive or reload failed | Read the journal for bind, permission, certificate, and unit-file errors. | Service state, listener, or deployment procedure. |
| All backend servers are down | Inspect LastChk, test each check from the proxy host, and verify firewall and TLS settings. |
Specific server or backend health-check definition. |
| Backend name equals the frontend and no server is selected | Review ACL order and add or correct a default_backend for unmatched requests. |
Frontend routing rules. |
| 502 with direct malformed or empty response | Repair application response framing, crashes, or HTTP/HTTPS mismatch. | Backend protocol or application. |
| 504 with long server timing | Investigate application latency and dependencies before adjusting timeout server. |
Backend performance, then a narrowly scoped timeout if justified. |
| TLS log names a handshake, DH, or cipher error | Reproduce with openssl s_client, then align certificate, SNI, protocol, and cipher policy. |
One TLS leg, certificate, or compatibility policy. |
Safe incident checklist
- Save the current configuration and note the exact service command line.
- Run
haproxy -c -fagainst that configuration before and after every edit. - Keep the incident timestamp, request details, status, termination state, and selected server together.
- Test client-to-frontend, HAProxy-to-backend TCP, and backend application protocol as separate legs.
- Use stats, Runtime API,
LastChk, and health-check logs to verify state changes. - Make the smallest correction that matches the evidence: one check, one route, one protocol setting, or one server.
- Reload through the normal service procedure and verify both the journal and a real request.
- Remove temporary verbose logging after collecting enough evidence.
When a fix changes a global timeout, cipher policy, listener limit, or default route, assess its blast radius first. A per-server health-check correction is usually safer than a backend-wide protocol change, and a backend-wide change is safer than a global setting that affects every frontend.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
