Production systems should always have PHP’s display_errors disabled and log_errors enabled so errors are logged instead of displayed to users. Of course, you’ll want a to be notified when errors happen and that’s where a nifty tool called SEC (Simple Event Correlator) comes in. It’s not very sexy, but its incredibly powerful and can be used for all sorts of log watching tasks.
Here are some helpful guides for getting started:
At HipChat we use a config like the following to to monitor Apache’s error_log for PHP errors and send us emails:
# Capture error lines and store them in apache-php-errors type=Single ptype=RegExp pattern=^\[.+\] \[error\] \[client .+\] PHP .+$ desc=PHP error or warning action=add apache-php-errors $0 # Report errors every minute if apache-php-errors is set type=Calendar time=* * * * * desc=Mail web errors context=apache-php-errors action=report apache-php-errors /usr/bin/mail -s "PHP errors" email@example.com; delete apache-php-errors;
Assuming you put this config in /etc/sec/apache.conf you’d run:
$ sec --conf=/etc/sec/apache.conf --input /var/log/apache2/error_log
Try writing a few of your own rules (the –debug flag is very helpful) or the examples in the tutorials above. SEC is incredibly powerful and can make complex monitoring tasks very simple.