使用Logstash收集PHP相关日志

这里收集三种日志

PHP的错误日志，PHP-FPM的错误日志和慢查询日志

在php.ini中设置
error_log = /data/app_data/php/logs/php_errors.log

在php-fpm.conf中设置
error_log = /data/app_data/php/logs/php-fpm_error.log
slowlog = /data/app_data/php/logs/php-fpm_slow.log

PHP错误日志如下：

[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/redis.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/redis.so
: cannot open shared object file: No such file or directory in Unknown on line 0
[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/apc.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/apc.so: ca
nnot open shared object file: No such file or directory in Unknown on line 0
[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/mongo.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/mongo.so
: cannot open shared object file: No such file or directory in Unknown on line 0

PHP-FPM错误日志如下：

[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 17:37:11] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 17:37:11] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 21:31:48] ERROR: unable to read what child say: Bad file descriptor (9)

PHP-FPM的慢查询日志如下：

[11-Mar-2015 16:54:17]  [pool www] pid 12873
script_filename = /data//index.php
[0x00007f497fa5b620] curl_exec() /data//Account.php:221
[0x00007f497fa5a4e0] call() /data/gintama_app/jidong/game_code/app/controllers/Game.php:31
[0x00007fff29eea180] load() unknown:0
[0x00007f497fa59e18] call_user_func_array() /data/library/BaseCtrl.php:20
[0x00007fff29eea470] handoutAction() unknown:0
[0x00007f497fa59400] run() /data//index.php:30

[11-Mar-2015 16:56:46]  [pool www] pid 12881
script_filename = /data/index.php
[0x00007f497fa5b620] curl_exec() /data//Account.php:221
[0x00007f497fa5a4e0] call() /data/Game.php:31
[0x00007fff29eea180] load() unknown:0
[0x00007f497fa59e18] call_user_func_array() /data/library/BaseCtrl.php:20
[0x00007fff29eea470] handoutAction() unknown:0
[0x00007f497fa59400] run() /data/index.php:30

添加Logstash的配置文件shipper_php-fpm.conf

input {

file {
type => "php_errors"
path => "/data/app_data/php/logs/php_errors.log"
sincedb_path => "/dev/null"
#          start_position => "beginning"
}
file {
type => "php-fpm_error"
path => "/data/app_data/php/logs/php-fpm_error.log"
sincedb_path => "/dev/null"
#          start_position => "beginning"
}
file {
type => "php-fpm_slow"
path => "/data/app_data/php/logs/php-fpm_slow.log"
sincedb_path => "/dev/null"
#          start_position => "beginning"
}

}

filter {
if [type] == "php_errors" {
mutate {
add_tag => ["zabbix-sender"]
add_field => [
"zabbix_host","%{host}",
"zabbix_item","php.errors"
#                "send_field","%{message}"
]
}

}
if [type] == "php-fpm_errors"{
mutate {
add_tag => ["zabbix-sender"]
add_field => [
"zabbix_host","%{host}",
"zabbix_item","php-fpm.error"
#                "send_field","%{message}"
]
}

}
if [type] == "php-fpm_slow" {
multiline {
pattern => "^(\[0x|$|script_filename)"
what    => "previous"
}

mutate {
add_tag => ["zabbix-sender"]
add_field => [
"zabbix_host","%{host}",
"zabbix_item","php-fpm.slow"
#                "send_field","%{message}"
]
}

}

}

output {

stdout {
codec => "rubydebug"

}

zabbix {
tags => "zabbix-sender"
host => "10.4.1.125"
port => "10051"
zabbix_sender => "/usr/local/zabbix/bin/zabbix_sender"

}

redis {
host => "10.4.29.162"
data_type => "list"
key => "logstash"
}

}

同理添加zabbixb报警模板

本文出自 “Linux SA John” 博客，请务必保留此出处http://john88wang.blog.51cto.com/2165294/1641723