HAProxy metrics are useful only when the stats path is understood

The HAProxy exporter reads HAProxy statistics and exposes them for Prometheus. Port 9101 is a common default. A scan of that port finds a large mixed population, so a count cannot be treated as an HAProxy exporter inventory without a response check.

The measurements

The queries on November 5, 2026 used sub_type=all and returned:

The port count is not a plausible count of HAProxy exporters. 9101 is used by many unrelated services and devices. The application fingerprint returned nothing, and the two build-information body matches are a much narrower signal that still needs a live verification.

The stats endpoint is the real dependency

The exporter connects to HAProxy's stats interface, which can be a web endpoint or a stats socket depending on configuration. That interface contains frontend, backend, server, health, and traffic data. It may require credentials or a restricted source address.

Protect the stats connection independently from the exporter's Prometheus listener. A public exporter is a disclosure risk, while a public HAProxy stats page can expose backend names and server states even without the exporter. Review both paths.

The exporter's scrape URI may contain a username and password. Keep the URI in a protected file or secret store. Do not print it in deployment logs or pass it through a shell history. Prefer a dedicated HAProxy stats user with read-only access.

Separate the proxy from the collector

An HAProxy process can be an internet-facing load balancer while its exporter remains on a management network. Do not assume the exporter shares the proxy's exposure. Compare the listener addresses, firewall rules, and route tables for both processes.

A public port 9101 could be a different service with a misleading number. Verify the HTTP response and the deployed process before treating the address as an exporter. The response should identify the exporter's expected metric names, and the host inventory should show the package and service unit.

Monitoring and change control

Track the exporter version, build information, scrape URI source, and HAProxy configuration version together. A backend name change can alter metric labels and dashboards, while a credential change can silently turn the collector into a failing check. Treat both as monitored changes.

Use a bounded scrape timeout and avoid returning unbounded labels from proxy statistics. A malicious or misconfigured backend name can increase metric cardinality. Keep external input out of label values where the exporter supports normalization.

Review the two-match result

The two body matches are candidate pages, not two confirmed exporters. An owner should check each match from the monitoring network, inspect the endpoint's response, and compare the result with the Prometheus target inventory. The huge port count should not be used as the denominator for a risk percentage.

The effective control is simple: HAProxy stats reachable only by the exporter, exporter reachable only by Prometheus, and the credential scoped to read-only statistics. The counts tell us where to search, not whether that control holds.

References

• HAProxy exporter
• HAProxy statistics interface
• Default port allocations
• ZoomEye search platform