How to Monitor Logs Using PHP Scripts on Linux Systems

How to Monitor Logs Using PHP Scripts on Linux Systems

With the widespread use of Linux systems on servers, system administrators rely heavily on log monitoring to ensure the stability of their systems. Changes in log files may contain critical error messages or system warnings, and real-time monitoring and analysis can prevent potential failures. PHP, being a lightweight scripting language, provides an easy way to implement log monitoring.

1. Create the PHP Script File

First, we need to create a PHP script file on the Linux system to monitor a specific log file.

Use a command-line text editor (like vi) to create a blank PHP file named "log_monitor.php", then input the following code:

<?php
// Specify the log file to monitor
$logFile = '/var/log/syslog';  // Modify this path as needed

// Get the initial file size
$fileSize = filesize($logFile);

// Continuously monitor the log file for changes
while (true) {
    clearstatcache();  // Clear the file status cache

    // Get the current file size
    $currentSize = filesize($logFile);

    // Check if the log file has changed
    if ($currentSize > $fileSize) {
        // The log file has changed, output the new content
        $handle = fopen($logFile, 'r');
        fseek($handle, $fileSize);  // Move the file pointer to the initial size
        $content = fread($handle, $currentSize - $fileSize);  // Read the content from the initial size to the current size
        fclose($handle);

        // Process the log content, such as outputting to the console or writing to another file
        echo $content;
    }

    // Update the initial file size to the current size
    $fileSize = $currentSize;

    // Sleep for a while to avoid excessive file reading
    sleep(1);
}
?>

Code explanation:

• Line 3: Specifies the path of the log file to be monitored, in this case, the system log file /var/log/syslog.
• Line 6: Gets the initial size of the log file.
• Lines 10-31: Creates an infinite loop to monitor the log file. It clears the file status cache, checks if the file size has changed, and if it has, reads and processes the new log content.

2. Run the PHP Script

Save the above code and exit the text editor. Then, run the PHP script using the following command in your Linux system:

php log_monitor.php

Once the script is running, it will continuously monitor the specified log file and output new content whenever the file changes.

Note: Before running the script, make sure PHP is properly installed on your system and that the PHP executable is included in your system's environment variables so that the script can run successfully.

3. Extension and Optimization

The example script provided above is a basic log monitoring script. You can customize and optimize it further based on your needs.

For example, you could use regular expressions to match specific log content, such as error messages or warning logs, and trigger alerts or other actions accordingly. Additionally, you could save the log content to a database or send it to a remote monitoring system for further analysis.

Furthermore, for more complex log management needs, consider using specialized log analysis tools such as Elasticsearch, Logstash, and Kibana, which provide more powerful capabilities for aggregating, searching, and analyzing log data.

Conclusion

By using PHP scripts for log monitoring, system administrators can monitor changes to log files on Linux systems in real time, promptly identifying and addressing potential issues. This article has covered the basics of creating a log monitoring script and provided ideas for extending and optimizing the script. We hope it helps you manage and analyze your system logs more effectively.