Skip to content

将php出错日志同步输出到splunk

vi /opt/php/etc/php.ini
打开syslog

; Log errors to specified file.
error_log = /opt/php/logs/php_error.log

; Log errors to syslog (Event Log on NT, not valid in Windows 95).
error_log = syslog

centos6为rsyslog,以下为syslog
vi /etc/rsyslog.conf
vi /etc/syslog.conf

#php log
user.* /opt/php/logs/php_error.log
#splunk
*.* @192.168.0.39

192.168.0.39为splunk所在ip,安装spunk可看这篇blog
重新reload syslog和php
将php出错日志同步输出到splunk并在本机保留一份日志
这里没有做日志切割,需要的自已加

在splunk可看到如下日志

01:37:13.000

<13>Jan 14 01:37:13 192.168.0.24 php-cgi: PHP Warning: mkdir() [function.mkdir]: File exists in /opt/htdocs/c1gblog/globals/class_cache.php on line 1013

host=192.168.0.24 选项|
sourcetype=syslog 选项|
source=tcp:1999 选项|
process=php-cgi 选项

Posted in 日志.

By C1G – 2014/01/14

« »