Tag Archives: apache2

Using php for analyzing apache logs

Apache has a nice feature that is to send the log output through a pipe. This avoid to configure syslog or create a listening server in php for syslog forwarding logs.

The changes in apache are really simple, you just need to write something like:

LogFormat "%v %A %D \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" mylog
CustomLog "|/usr/bin/php5 [PATH_TO_SCRIPT]/apache-stdin.php log" mylog
ErrorLog "|/usr/bin/php5 [PATH_TO_SCRIPT]/apache-stdin.php error"

In apache-stdin.php the flow is very simple, you just need to do:

$fp = fopen('php://stdin', 'r');
do {
	//read a line from apache, if not, will block until have it
	$data = fgets($fp);
	$data = trim($data); //remove line end

	if (empty($data)) {
		break; //no more data so finish it

	//process the data
} while(true);


As you can see it’s basically reading a line and processing.

I’ve built a helper script around this at:

Where you can pass an additional param to specify it’s a normal log, or the error log; like in the apache configuration I’ve posted.

You can also configure the log format you are using in apache to get you a simple description like:

$format = '%v %A %D \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"';

With this, it will give you an array like:

'hostname' => 'danguer.com',
'local_ip' =>,
'time_ms' => 0.0002,
'first_line_request' => 'GET / HTTP/1.1',
'status_last' => 200,
'bytes_sent' => 2048

From there you can use for storing in a file (it’s the common behavior of this script), insert into a db, use simpledb, etc.


Installing php-fpm and apache2

I’ve readed a lot of tutorials of using nginx and php-fpm.
I’m still using apache2 much more due the .htaccess easiness that allow with rewriting and password protect (despite using other modules like mod_svn, etc)

Even I haven’t found a 100% transparent solution like ngninx, here is what I’m using to work with php-fpm and apache2. Here are the steps in debian:

  • echo "deb http://packages.dotdeb.org stable all" >> /etc/apt/sources.list
  • apt-get update
  • apt-get install libapache2-mod-fastcgi apache2-mpm-worker php5-fpm php5-common php5-cli
  • do all the apt-get of all php5-* modules you want
  • Add the following to a new file: /etc/apache2/mods-enabled/fpm.load
    AddType application/x-httpd-fastphp5 .php .phtml
    Action application/x-httpd-fastphp5 /fast-cgi-fake-handler
  • in /etc/php5/fpm/pool.d/www.conf change:
    listen =


    ; listen =
     listen = /var/run/php-fpm.socket

    This will enable the unix socket which should be faster

  • /etc/init.d/php-fpm restart
  • /etc/init.d/apache2 restart


With this you will be able to use php-fpm through a /fast-cgi-fake-handler so for example in your /etc/apache2/sites-enabled/000-default your file will look like:

FastCGIExternalServer /var/www/fast-cgi-fake-handler -socket /var/run/php-fpm.socket
DocumentRoot /var/www

The system will rewrite /index.php path into: /fast-cgi-fake-handler/index.php which will be passed to the fastcgi

This have two problems:

  1. You need to set the FastCGIExternalServer like ${DOCUMENT_ROOT}/fast-cgi-fake-handler in all your virtual hosts to make it work
  2. Zend framework and other which use the consume all url’s pattern to pass through index.php will not work as will generate an endless loop, there is an easy solution, in your .htaccess use after RewriteEngine On:
    RewriteRule ^fast-cgi-fake-handler/ - [L,NC]

    this will skip processing all urls which contain “fast-cgi-fake-handler” at start; or of course use a RewriteCond to avoid this.