Setup email alerts for PHP errors

This howto is tested on:

• Debian 5.0 Lenny
• Debian 6.0 Squeeze

Prerequisites

This howto needs :

• a working PHP setup, as described by Install PHP-FPM on Debian.
• the logging of PHP errors with Syslog, as described by Log PHP errors with Syslog.

Setup

Install Simple Event Correlator :

command apt-get install sec

Create a folder for the configuration files :

command mkdir --parents "/etc/sec"

Create the Apache 2 error logs watch script :

command echo '# Capture error lines and store them in php-errors
type=Single
ptype=RegExp
pattern=^\[.+\] \[error\] \[client .+\] PHP .+$
desc=PHP error or warning
action=add php-errors $0
 
# Report errors every minute if php-errors is set
type=Calendar
time=* * * * *
desc=Mail PHP errors
context=php-errors
action=report php-errors /usr/bin/mail -s "PHP errors" root@localhost; delete php-errors;
' > "/etc/sec/apache2-php-errors.conf"

Create the LigHTTPd error logs watch script :

command echo '# Capture error lines and store them in php-errors
type=Single
ptype=RegExp
pattern=^.+: \(mod_fastcgi\.c\..+\) .+$
desc=PHP error or warning
action=add php-errors $0
 
# Report errors every minute if php-errors is set
type=Calendar
time=* * * * *
desc=Mail PHP errors
context=php-errors
action=report php-errors /usr/bin/mail -s "PHP errors" root@localhost; delete php-errors;
' > "/etc/sec/lighttpd-php-errors.conf"

Create the Syslog PHP error log watch script :

command echo '# Capture error lines and store them in php-errors
type=Single
ptype=RegExp
pattern=^.+: PHP .+$
desc=PHP error or warning
action=add php-errors $0
 
# Report errors every minute if php-errors is set
type=Calendar
time=* * * * *
desc=Mail PHP errors
context=php-errors
action=report php-errors /usr/bin/mail -s "PHP errors" root@localhost; delete php-errors;
' > "/etc/sec/syslog-php-errors.conf"

Setup the alert daemon :

if [ -n "$(command grep '/php.log' '/etc/syslog-ng/syslog-ng.conf')" ]; then
command echo '
# PHP monitoring defaults
RUN_DAEMON="yes"
DAEMON_ARGS="-conf=/etc/sec/syslog-php-errors.conf -input=/var/log/php.log -pid=/var/run/sec.pid -detach -syslog=daemon"
' >> "/etc/default/sec"
elif [ -d "/var/log/apache2" ]; then
  command echo '
# PHP monitoring defaults
RUN_DAEMON="yes"
DAEMON_ARGS="-conf=/etc/sec/apache2-php-errors.conf -input=/var/log/apache2/*error.log -pid=/var/run/sec.pid -detach -syslog=daemon"
' >> "/etc/default/sec"
elif [ -d "/var/log/lighttpd" ]; then
  command echo '
# PHP monitoring defaults
RUN_DAEMON="yes"
DAEMON_ARGS="-conf=/etc/sec/lighttpd-php-errors.conf -input=/var/log/lighttpd/*error.log -pid=/var/run/sec.pid -detach -syslog=daemon"
' >> "/etc/default/sec"
fi

Start the daemon :

/etc/init.d/sec start

The root user will now be e-mailed PHP errors when they appears.

Error log level

If you do not control the PHP software present on the server (free software for example), make sure that notice and deprecated PHP messages are not added to log file, in order to limit email reports number :

echo "; PHP error log level
error_reporting = E_ALL & ~E_DEPRECATED & ~E_NOTICE" \
    > '/etc/php5/conf.d/error_reporting.ini'

Reload PHP configuration :

test -x /etc/init.d/php5-fpm && /etc/init.d/php5-fpm force-reload
test -x /etc/init.d/apache2 && /etc/init.d/apache2 force-reload
test -x /etc/init.d/lighttpd && /etc/init.d/lighttpd force-reload
test -x /etc/init.d/nginx && /etc/init.d/nginx force-reload

Thanks

• Thanks to S.E.C., the Simple Event Correlator (en) developers.
• Thanks to Garret of powdahound.com (en) for his post Emails alerts for PHP errors via SEC (en).
• Thanks to GuiguiAbloc (en) for his post Interception des erreurs applicatives dans Nagios avec SEC et Prelude-lml (en).