HAProxy truncates the host_header part of some log messages

Since these have the exact same time stamps and timings, I am guessing you are not including actual examples.

Without those examples the best I can think of is to try setting the length of those header field manually with something like:

capture request header Host len 50

Also note that since syslog traffic is UDP a certain amount of corruption is to be expected (although this sounds more specific than that). There is also a max length setting in HAProxy. I never followed through with increasing this but if you want to try here is my correspondence with the HAProxy author:

> Can I increase the length of syslog messages sent out by HAProxy?
>
> Would it be as simple as changing:
> #define MAX_SYSLOG_LEN          1024
> In
> include/types/log.h
>
> Or is there more to it than that?

You can try, but it may do anything depending on your syslog server.
Some accept those messages, some do truncate the lines, YMMV."

From what I'm seeing in the code, this should not be possible at all (check capture_headers() in proto_http.c). The headers are truncated to the length that was requested. For this reason, if you're certain that you're seeing this behaviour on requests for a same host passing through the same frontend, the only possibility I can think of is that you sometimes have two header fields, one with the shortened value and another one with the normal one, and that haproxy only logs the first one while the server uses the last one.