{"id":13745,"date":"2025-12-16T13:59:09","date_gmt":"2025-12-16T08:29:09","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=13745"},"modified":"2025-12-24T16:13:58","modified_gmt":"2025-12-24T10:43:58","slug":"optimize-haproxy-on-linux","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/optimize-haproxy-on-linux","title":{"rendered":"How to Optimize HAProxy on Linux Server for High Traffic"},"content":{"rendered":"\n<p>To optimize HAProxy on a Linux server, upgrade to a recent release (2.6+), right-size max connections and timeouts, enable multithreading with CPU pinning, tune SSL\/TLS and HTTP\/2, harden logging and observability, and apply safe Linux kernel and ulimit tweaks. Validate with load tests, monitor latency percentiles, and use zero\u2011downtime reloads.<\/p>\n\n\n\n<p>In this guide, you\u2019ll learn how to optimize HAProxy on a Linux server step by step. We\u2019ll cover HAProxy tuning, Linux kernel parameters, SSL offloading, HTTP\/2, logging, caching, and real-world configuration examples. Whether you run a WordPress stack, APIs, or microservices, these practices boost throughput, reduce latency, and improve reliability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"search-intent-and-what-youll-learn\"><strong>Search Intent and What You\u2019ll Learn<\/strong><\/h2>\n\n\n\n<p>Searchers looking for \u201cHow to Optimize HAProxy on <a href=\"https:\/\/www.youstable.com\/blog\/configure-mongodb-on-linux\/\">Linux Server<\/a>\u201d need practical, copy\u2011paste configurations, Linux sysctl values, and clear explanations that work in production. This tutorial focuses on safety, performance, and observability, with notes from 12+ years of hands-on hosting experience at scale.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"prerequisites-and-baselines\"><strong>Prerequisites and Baselines<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Linux distro: <\/strong>Ubuntu 20.04+\/Debian 11+\/RHEL 8+\/Alma\/Rocky. Keep the kernel up to date.<\/li>\n\n\n\n<li><strong>HAProxy:<\/strong> prefer 2.4 LTS or newer (2.6\/2.8 recommended) for threads, HTTP\/2, improved TLS, and runtime API.<\/li>\n\n\n\n<li><strong>Workload clarity: <\/strong>know if traffic is HTTP\/1.1, HTTP\/2, or TCP; average\/peak RPS; TLS termination or passthrough; connection reuse expectations.<\/li>\n\n\n\n<li><strong>Baseline metrics:<\/strong> collect current latency (p50\/p95), error rates, CPU, and connection counts before tuning.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"step-by-step-optimize-haproxy-on-a-linux-server\"><strong>Step-by-Step: Optimize HAProxy on a Linux Server<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"1-keep-haproxy-updated-and-enable-modern-features\"><strong>1) Keep HAProxy Updated and Enable Modern Features<\/strong><\/h3>\n\n\n\n<p>Newer HAProxy releases dramatically improve performance and observability. Use distribution backports or the official HAProxy APT\/YUM repositories. Enable threads (nbthread), master-worker mode, runtime API, and HTTP\/2 where applicable.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \/etc\/haproxy\/haproxy.cfg (global excerpt)\nglobal\n  daemon\n  master-worker\n  nbthread 4\n  cpu-map auto:1\/1-4 0-3\n  maxconn 200000\n  tune.bufsize 32768\n  tune.maxaccept 200\n  stats socket \/run\/haproxy\/admin.sock mode 660 level admin expose-fd listeners\n  log \/dev\/log local0 info\n\ndefaults\n  mode http\n  option httplog\n  timeout client 30s\n  timeout server 30s\n  timeout connect 5s\n  timeout http-request 5s\n  timeout http-keep-alive 10s\n  retries 2\n  option redispatch<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"2-size-connections-and-timeouts-correctly\"><strong>2) Size Connections and Timeouts Correctly<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>maxconn: set at global and backend levels to cap memory usage while avoiding accept queue overflows.<\/li>\n\n\n\n<li>Timeouts: keep them strict to free idle resources without breaking legitimate keep\u2011alives (client\/server\/connect\/http\u2011keep\u2011alive\/http\u2011request).<\/li>\n\n\n\n<li>Queueing: use timeout queue and reasonable maxqueue per server to avoid unbounded waits.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>defaults\n  timeout queue 30s\n  default-server maxconn 1000 maxqueue 512\n\nbackend app\n  balance leastconn\n  http-reuse safe\n  server app1 10.0.0.11:8080 check inter 2s rise 3 fall 2 maxconn 2000\n  server app2 10.0.0.12:8080 check inter 2s rise 3 fall 2 maxconn 2000<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"3-use-threads-cpu-pinning-and-accept-tuning\"><strong>3) Use Threads, CPU Pinning, and Accept Tuning<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>nbthread: set to the number of physical cores (or start with half the CPUs if noisy neighbors exist).<\/li>\n\n\n\n<li>cpu-map: pin threads to CPU cores for cache locality and lower context switching.<\/li>\n\n\n\n<li>tune.maxaccept: increase to reduce accept lock contention under high bursts.<\/li>\n<\/ul>\n\n\n\n<p>On multi-core servers, threads with CPU pinning often outperform multi\u2011process setups, simplifying stats and connection sharing. Validate with your workload.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"4-tune-ssl-tls-offloading-and-http-2\"><strong>4) Tune SSL\/TLS Offloading and HTTP\/2<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable ALPN for h2 and http\/1.1.<\/li>\n\n\n\n<li>Use modern cipher suites and disable legacy TLS versions.<\/li>\n\n\n\n<li>Increase TLS session cache for high\u2011RPS sites; consider ECDSA certificates for speed.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>frontend https_in\n  bind :443 ssl crt \/etc\/haproxy\/certs\/example.pem alpn h2,http\/1.1\n  ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11\n  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\n  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256\n\n  http-request set-header X-Forwarded-Proto https\n  option forwardfor\n  default_backend app<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"5-health-checks-retries-and-connection-reuse\"><strong>5) Health Checks, Retries, and Connection Reuse<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use lightweight HTTP health checks with short intervals and proper rise\/fall to avoid flapping.<\/li>\n\n\n\n<li>Enable http-reuse safe or server close based on backend behavior. Reuse reduces TCP\/TLS handshakes.<\/li>\n\n\n\n<li>Keep retries low to avoid thundering herds; prefer fast failover.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>backend app\n  option httpchk GET \/health\n  http-check expect status 200\n  balance leastconn\n  http-reuse safe\n  server app1 10.0.0.11:8080 check inter 2s rise 3 fall 2\n  server app2 10.0.0.12:8080 check inter 2s rise 3 fall 2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"6-logging-observability-and-metrics\"><strong>6) Logging, Observability, and Metrics<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable structured logging with response timings to diagnose latency (Tq\/Tw\/Tc\/Tr\/Tt).<\/li>\n\n\n\n<li>Expose a stats socket and a protected stats page; integrate Prometheus via haproxy_exporter scraping the socket.<\/li>\n\n\n\n<li>Alert on rising 5xx, queue time, and connection errors.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>global\n  log \/dev\/log local0 info\n  stats socket \/run\/haproxy\/admin.sock mode 660 level admin\n  # Example log format with timings and unique request ID\n  log-format \"%ci:%cp &#91;%t] %ft %b\/%s %TR\/%Tw\/%Tc\/%Tr\/%Ta %ST %B %CC %CS %{+Q}r uid:%ID\"\n\nlisten stats\n  bind :8404\n  stats enable\n  stats uri \/haproxy?stats\n  stats auth admin:strongpassword<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"7-enable-compression-and-caching-carefully\"><strong>7) Enable Compression and Caching Carefully<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Compression saves bandwidth but costs CPU; enable only for text types and when upstream isn\u2019t compressing.<\/li>\n\n\n\n<li>HAProxy\u2019s built-in cache is useful for small, frequently requested objects; set sensible caps.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>frontend https_in\n  # Compress only compressible types\n  compression algo gzip\n  compression type text\/html text\/plain text\/css application\/javascript application\/json\n\n# Simple micro-cache (HAProxy 2.0+)\ncache microcache\n  total-max-size 128\n  max-object-size 1048576\n  max-age 60\n\nbackend static\n  http-response cache-store microcache if { status 200 }<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"8-zero-downtime-reloads-and-graceful-drains\"><strong>8) Zero\u2011Downtime Reloads and Graceful Drains<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use master-worker with seamless reloads; keep short hard-stop-after so old workers exit after draining.<\/li>\n\n\n\n<li>Drain nodes before maintenance using the admin socket (set weight 0 or disable server).<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>global\n  master-worker\n  hard-stop-after 30s\n\n# Drain a server via admin socket:\n# echo \"disable server app\/app1\" | socat stdio \/run\/haproxy\/admin.sock<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"linux-kernel-and-system-tuning-for-haproxy\"><strong>Linux Kernel and System Tuning for HAProxy<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"network-sysctl-recommendations-safe-defaults\"><strong>Network sysctl Recommendations (safe defaults)<\/strong><\/h3>\n\n\n\n<p>Apply these values in \/etc\/sysctl.d\/99-haproxy.conf and run sysctl &#8211;system. Always test under load in a staging environment before production rollout.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>net.core.somaxconn = 65535\nnet.core.netdev_max_backlog = 32768\n\nnet.ipv4.tcp_max_syn_backlog = 262144\nnet.ipv4.tcp_syncookies = 1\n\nnet.ipv4.ip_local_port_range = 1024 65000\n\nnet.ipv4.tcp_fin_timeout = 15\nnet.ipv4.tcp_tw_reuse = 1\nnet.ipv4.tcp_mtu_probing = 1\nnet.ipv4.tcp_slow_start_after_idle = 0\n\nnet.core.rmem_max = 268435456\nnet.core.wmem_max = 268435456\nnet.ipv4.tcp_rmem = 4096 87380 134217728\nnet.ipv4.tcp_wmem = 4096 65536 134217728\n\nnet.ipv4.tcp_keepalive_time = 600\nnet.ipv4.tcp_keepalive_intvl = 30\nnet.ipv4.tcp_keepalive_probes = 5<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"file-descriptors-and-systemd-limits\"><strong>File Descriptors and Systemd Limits<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HAProxy uses one FD per connection direction; raise limits generously on busy nodes.<\/li>\n\n\n\n<li>Set both OS and systemd limits to avoid silent caps.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code># \/etc\/security\/limits.d\/99-haproxy.conf\nhaproxy soft nofile 200000\nhaproxy hard nofile 200000\n\n# \/etc\/systemd\/system\/haproxy.service.d\/override.conf\n&#91;Service]\nLimitNOFILE=200000<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"nic-and-irq-considerations\"><strong>NIC and IRQ Considerations<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable RSS\/RPS\/RFS where available; ensure NIC queues scale with CPU cores.<\/li>\n\n\n\n<li>Disable GRO\/LRO for latency-sensitive TCP proxies if testing shows improvement.<\/li>\n\n\n\n<li>Keep BIOS and NIC firmware updated; pin heavy IRQs away from HAProxy threads when needed.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"example-a-clean-optimized-haproxy-cfg\"><strong>Example: A Clean, Optimized haproxy.cfg<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>global\n  daemon\n  master-worker\n  nbthread 4\n  cpu-map auto:1\/1-4 0-3\n  maxconn 200000\n  tune.bufsize 32768\n  tune.maxaccept 200\n  stats socket \/run\/haproxy\/admin.sock mode 660 level admin expose-fd listeners\n  log \/dev\/log local0 info\n\ndefaults\n  mode http\n  option httplog\n  option http-keep-alive\n  option forwardfor\n  timeout client 30s\n  timeout server 30s\n  timeout connect 5s\n  timeout http-keep-alive 10s\n  timeout http-request 5s\n  timeout queue 30s\n  retries 2\n  default-server maxconn 2000 maxqueue 512 check inter 2s fall 2 rise 3\n\nfrontend http_in\n  bind :80\n  http-request redirect scheme https code 301 unless { ssl_fc }\n\nfrontend https_in\n  bind :443 ssl crt \/etc\/haproxy\/certs\/example.pem alpn h2,http\/1.1\n  ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11\n  http-request set-header X-Forwarded-Proto https\n  default_backend app\n\nbackend app\n  balance leastconn\n  http-reuse safe\n  server app1 10.0.0.11:8080\n  server app2 10.0.0.12:8080\n\nlisten stats\n  bind :8404\n  stats enable\n  stats uri \/haproxy?stats\n  stats auth admin:strongpassword<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"capacity-planning-and-load-testing\"><strong>Capacity Planning and Load Testing<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"tools-to-validate-your-tuning\"><strong>Tools to Validate Your Tuning<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>wrk or wrk2: HTTP load generation with latency percentiles.<\/li>\n\n\n\n<li>h2load: stresses HTTP\/2 endpoints.<\/li>\n\n\n\n<li>vegeta: programmable attacks, great for CI.<\/li>\n\n\n\n<li>haproxy stats socket: show info and show stat for real\u2011time internals.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"how-to-read-haproxy-timings\"><strong>How to Read HAProxy Timings<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Tq (request header time): client to HAProxy.<\/li>\n\n\n\n<li>Tw (queue time): time spent waiting for a free server slot.<\/li>\n\n\n\n<li>Tc (connect time): TCP connect to backend.<\/li>\n\n\n\n<li>Tr (response time): server processing until first byte.<\/li>\n\n\n\n<li>Ta (total time): end\u2011to\u2011end latency; focus on p95\/p99.<\/li>\n<\/ul>\n\n\n\n<p>High Tw means server-side saturation; increase backend maxconn, add instances, or reduce keep\u2011alive. High Tc suggests network issues or SYN backlog limits. High Tr points to app performance bottlenecks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"common-pitfalls-to-avoid\"><strong>Common Pitfalls to Avoid<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Overly long timeouts causing FD exhaustion under slow clients.<\/li>\n\n\n\n<li>Huge compression lists that spike CPU without real bandwidth gains.<\/li>\n\n\n\n<li>Ignoring logs; many performance issues are visible as rising Tw\/Tc or 5xx surges.<\/li>\n\n\n\n<li>Reloads without master-worker, causing dropped connections.<\/li>\n\n\n\n<li>Forgetting systemd LimitNOFILE, leading to unexpected caps despite sysctl changes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"when-to-scale-out-vs-tune-more\"><strong>When to Scale Out vs. Tune More<\/strong><\/h2>\n\n\n\n<p>If CPU remains above 75\u201380% at peak after applying the above optimizations, or if latency p95 is above your SLO while HAProxy is not queueing, it\u2019s time to add more HAProxy instances or move to larger compute. Use anycast or DNS <a href=\"https:\/\/www.youstable.com\/blog\/install-load-balancer-on-linux\/\">load balancing<\/a> to distribute traffic across nodes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"managed-haproxy-and-linux-tuning-with-youstable\"><strong>Managed HAProxy and Linux Tuning with YouStable<\/strong><\/h2>\n\n\n\n<p>If you prefer experts to handle configuration, monitoring, and scaling, YouStable\u2019s <a href=\"https:\/\/www.youstable.com\/blog\/benefits-of-fully-managed-dedicated-server\/\">managed hosting<\/a> team can deploy, benchmark, and tune HAProxy on your Linux servers or cloud instances. We deliver zero\u2011downtime migrations, custom logging\/metrics, and SLA\u2011driven performance, so your apps stay fast under traffic spikes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs-how-to-optimize-haproxy-on-linux-server\"><strong>FAQs: How to Optimize HAProxy on Linux Server<\/strong><\/h2>\n\n\n\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"what-is-the-best-haproxy-version-for-performance\">What is the best HAProxy version for performance?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Use HAProxy 2.4 LTS or newer (2.6\/2.8 recommended). You get improved threading, HTTP\/2, runtime API, and numerous performance fixes. Avoid very old 1.x\/2.0 releases when performance and security matter.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-many-threads-nbthread-should-i-use\">How many threads (nbthread) should I use?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Start with the number of physical cores (e.g., 4\u20138) and pin them with cpu-map. Validate with load tests; some workloads benefit from fewer threads to reduce contention, while others scale linearly with cores.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"which-timeouts-are-most-important\">Which timeouts are most important?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>timeout connect (backend connect), timeout server\/client (overall), timeout http-request (request header), and timeout http-keep-alive (idle reuse). Tighten them to protect resources while keeping legitimate keep\u2011alive sessions stable.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"should-i-enable-http-2-and-tls-offloading-in-haproxy\">Should I enable HTTP\/2 and TLS offloading in HAProxy?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Yes, if your HAProxy handles HTTPS. Enable ALPN h2,http\/1.1 and use modern cipher suites. Offloading TLS at HAProxy reduces backend load and improves connection reuse, especially for dynamic sites and APIs.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"what-linux-kernel-tweaks-give-the-biggest-gains\">What Linux kernel tweaks give the biggest gains?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Increase somaxconn and netdev backlog, widen ip_local_port_range, raise SYN backlog, and ensure generous rmem\/wmem buffers. Don\u2019t forget high file-descriptor limits via systemd. Always test changes with realistic traffic before production.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\n<script type=\"application\/ld+json\">\n\t{\n\t\t\"@context\": \"https:\/\/schema.org\",\n\t\t\"@type\": \"FAQPage\",\n\t\t\"mainEntity\": [\n\t\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"What is the best HAProxy version for performance?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Use HAProxy 2.4 LTS or newer (2.6\/2.8 recommended). You get improved threading, HTTP\/2, runtime API, and numerous performance fixes. Avoid very old 1.x\/2.0 releases when performance and security matter.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How many threads (nbthread) should I use?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Start with the number of physical cores (e.g., 4\u20138) and pin them with cpu-map. Validate with load tests; some workloads benefit from fewer threads to reduce contention, while others scale linearly with cores.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Which timeouts are most important?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>timeout connect (backend connect), timeout server\/client (overall), timeout http-request (request header), and timeout http-keep-alive (idle reuse). Tighten them to protect resources while keeping legitimate keep\u2011alive sessions stable.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Should I enable HTTP\/2 and TLS offloading in HAProxy?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Yes, if your HAProxy handles HTTPS. Enable ALPN h2,http\/1.1 and use modern cipher suites. Offloading TLS at HAProxy reduces backend load and improves connection reuse, especially for dynamic sites and APIs.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"What Linux kernel tweaks give the biggest gains?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Increase somaxconn and netdev backlog, widen ip_local_port_range, raise SYN backlog, and ensure generous rmem\/wmem buffers. Don\u2019t forget high file-descriptor limits via systemd. Always test changes with realistic traffic before production.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t\t\t\t]\n\t}\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>To optimize HAProxy on a Linux server, upgrade to a recent release (2.6+), right-size max connections and timeouts, enable multithreading [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":14074,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[350],"tags":[2141,2163],"class_list":["post-13745","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase","tag-linux-server","tag-optimize-haproxy-on-linux"],"acf":[],"featured_image_src":"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/How-to-Optimize-HAProxy-on-Linux-Server.jpg","author_info":{"display_name":"Prahlad Prajapati","author_link":"https:\/\/www.youstable.com\/blog\/author\/prahladblog"},"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/13745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=13745"}],"version-history":[{"count":2,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/13745\/revisions"}],"predecessor-version":[{"id":14066,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/13745\/revisions\/14066"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/14074"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=13745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=13745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=13745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}