PHP Logging & PHP Syslog Management

Loggly provides the infrastructure to aggregate and normalize log events so they are available to explore interactively, build visualizations, or create threshold-based alerting. In general, any method to send logs from a system or application to an external source can be adapted to send logs to Loggly. The following instructions provide one scenario for sending logs to Loggly.

We’ll show you how to setup your PHP logging, which is to send syslog to Rsyslog and then forward it to Loggly. The advantage of Rsyslog is that it can send TCP events without blocking your application, can optionally encrypt the data, and even queue data to add robustness to network failure.

• This guide was tested with Ubuntu 16.04-LTS, PHP 7.0.22, Apache 2.4.18 and the default log configuration and directories.

For alternatives, please see the PHP Logging Advanced Options section.

PHP Log Setup

1. Configure Syslog Daemon

If you haven’t already, run our automatic Configure-Syslog script below to setup rsyslog. Alternatively, you can Manually Configure Rsyslog or Syslog-ng.

curl -O https://www.loggly.com/install/configure-linux.sh
sudo bash configure-linux.sh -a SUBDOMAIN -u USERNAME 

Replace:

• SUBDOMAIN: your account subdomain that you created when you signed up for Loggly
• USERNAME: your Loggly username

2. PHP Configuration to Use Syslog with Apache

Open the php.ini file, in this case for apache:

For PHP 7, the path for php.ini is as follows

sudo vim /etc/php/7.x/cli/php.ini 

For PHP 5, the path for php.ini is as follows

sudo vim /etc/php5/5.x/apache2/php.ini 

Note: Replace "5.x" and "7.x" with your PHP version number.

Configure it to log over syslog by uncommenting this line:

;; Log errors to syslog (Event Log on Windows).

error_log = syslog 

Restart Apache so the changes take effect

sudo service apache2 restart 

Open or create a new loggly configuration file for rsyslog and paste in this configuration:

#     -------------------------------------------------------
#     Syslog Logging Directives for PHP
#     -------------------------------------------------------

#Add a tag for Nginx events
$template LogglyFormatPHP,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [TOKEN@41058 tag=\"PHP\"] %msg%\n"

$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g  # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList  # run asynchronously
$ActionResumeRetryCount -1  # infinite retries if host is down

# Send messages to Loggly over TCP using the template.
*.* @@logs-01.loggly.com:514;LogglyFormatPHP 

3. PHP Configuration to Use Syslog with Nginx

Open or create a new loggly configuration file for rsyslog and paste in this configuration:

#     -------------------------------------------------------
#     Syslog Logging Directives for Nginx
#     -------------------------------------------------------
#Add a tag for Nginx events

$template LogglyFormatNginx,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [TOKEN@41058 tag=\"Nginx\"] %msg%\n"
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g  # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList  # run asynchronously
$ActionResumeRetryCount -1  # infinite retries if host is down

# Send messages to Loggly over TCP using the template.
*.* @@logs-01.loggly.com:514;LogglyFormatNginx

4. Try Sending Logs

Open a PHP file in your Apache document root to test adding some log commands

sudo vim /var/www/html/test.php 

Add some sample code to produce two lines of output in the syslog

<?php
openlog('php', LOG_CONS | LOG_NDELAY | LOG_PID, LOG_USER | LOG_PERROR);
syslog(LOG_ERR, 'Error!');
syslog(LOG_INFO, 'Hello World!');
closelog();
?> 

5. Verify Events

Search Loggly for this event. If it doesn’t work, see the troubleshooting section below.

syslog.appName:"php" 

or using the tags you have used.

Click on one of the logs to show a list of php log fields (see screenshot below). If you don’t see them, please check that you are using one of our automatically parsed formats.

Advanced PHP Logging Options

• PHP Monolog – The popular monolog library can also send to Loggly.
• File Monitoring – You can also configure PHP to log to file by uncommenting "error_log = php_errors.log", then monitor that file using Rsyslog. This gives you a local backup.
• Search or post your own PHP logging, PHP syslog examples, and PHP error log questions in the community forum.

PHP Logging Troubleshooting

If you don’t see any data show up in the verification step, then check for these common problems.

Check PHP:

• Wait a few minutes in case indexing needs to catch up
• Make sure you restarted Apache after making the changes
• Check to see if PHP’s logs are getting to Rsyslog by examining the system log at /var/log/syslog
• Run "sudo tcpdump -nnvvXS dst port 514" to verify UDP events are being sent to localhost

Check Your Syslog Daemon:

• Troubleshooting Rsyslog

Still Not Working?

• Search or post your own PHP logs record questions, PHP examples, PHP references and setup, or PHP tutorials in the community forum.

The scripts are not supported under any SolarWinds support program or service. The scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.