[SOLVED] PHP error notifications? Logwatch?

Zmyrgel · 07-08-2011, 05:44 AM

I need to monitor PHP errors / warnings on few of our servers. The idea is to send email to developers / admins when PHP error/warning occurs on the server. Currently we run very ugly shell script from cron to do this which I want to replace with something better.

I was thinking would logwatch be a good candidate for this. Run logwatch from cron every 5 minutes to check php service logs for the last 5 minutes?

I've tried to get logwatch to check logs for last x minutes but so far without luck. Anyone already done this or should I go some other route with this?

I'm using SLES as my test machine. I've installed the logwatch rpm and configured the PHP settings as shown here.

Currently I can get php log output when specifying '--range All' but how to tell it to display last few minutes logs?

I've tried lot of range variations but nothing seems to work.

For example

Code:

# loogwatch --print --detail High --archives --service php --range '-60 minutes'

Code:

################### Logwatch 7.3.6 (05/19/07) #################### 
        Processing Initiated: Fri Jul  8 13:35:24 2011
        Date Range Processed: -60 minutes
                              ( 2011-Jul-08 )
                              Period is day.
      Detail Level of Output: 10
              Type of Output: unformatted
           Logfiles for Host: foobar
  ################################################################## 
 
 --------------------- php-messages Begin ------------------------ 

 Warnings:
 
 1 times:
 [... Jul 08 07:16:03 2011]  fopen(welcome.txt) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: No such file or directory in /home/tmy/public_html/foobar.php on line 3
 
 
 ---------------------- php-messages End ------------------------- 

 
 ###################### Logwatch End #########################

Why does logwatch include just the above entry and not anything after it? The above entry was written some 6 hours ago and there's few other PHP errors which happened less than hour ago which aren't listed.

I also tested adding 'for that minute / for those minutes' to the range command but then it won't output anything at all.

kbp · 07-12-2011, 12:23 AM

What version of logwatch are you using? .. a quick 'man logwatch' internet search says :-

Quote:

--range range
You can specify a date-range to process. This option is currently limited to only Yesterday, Today and All.

<edit>just noticed your version in the output... check your man pages to see what --range says</edit>

Noway2 · 07-12-2011, 04:21 AM

For what its worth, I am running OSSEC on a machine that I am doing PHP development on. It sends me an alert, usually within seconds, when an Apache or PHP error has been encountered. While not exactly what the application was intended for, it might serve your purpose.

Zmyrgel · 07-12-2011, 11:48 PM

Quote:

Originally Posted by kbp

What version of logwatch are you using? .. a quick 'man logwatch' internet search says :-

<edit>just noticed your version in the output... check your man pages to see what --range says</edit>

Forgot to mention that the Date::Manip module is installed and detected so --range supports all those extra options.

Found the cause for the error too. Apparently logwatch doesn't like single quotes and needs double quotes for the range specification for it to detect them correctly. Fixing the quotes and then tweaking the parameters a bit I got it to work almost as needed. Apparently the stock php script doesn't bother to check PHP Parse Errors from the logs so I need to tweak the script a bit for our needs.

OSSEC seems interesting too, got to delve into it when I have the time.