The attached patch should activate syslog sypport to error_log only. You can try 
it on trunk.

change error_log to "syslog"

You can also set
syslog_facility and syslog_ident to feet your needs. But default values should 
be OK.

I'm working on the slowlog patch also but it's a bit more complicated.
++ Jerome

Great job! :-)

I'll try it out and report feedback to you.

You can try instead the new revision of the patch I've just attached.

It adds sending slowlog to syslog.

Set slowlog to syslog. Moreover you can set slowlog_syslog_level to same values as 
log_level. By default it's LOG_DEBUG. There is no way to change the ident and the 
facility for slowlog, it takes the same values as the globals ones 
(syslog_facility and syslog_event). There is no need to because the pool name is 
prepended to every slowlog message.

my mistakes. The v2 patch was buggy. Use v3 instead.

Sorry it took me so long to reply. Too much work and too few spare time.

Netherless I reviewed the patch and fixed some problems.

If trace failed in fpm_php_trace.c:fpm_php_trace, there was a call to fwrite with a NULL pointer. Added syslog here.

In fpm_stdio.c:fpm_stdio_init_child a close was performed on the fd set to ZLOG_SYSLOG. (valgrind complained)

In fpm_stio.c:fpm_stdio_open_error_log, the variable syslog shadowed syslog() - renamed it to syslog_opened. It didn't matter from the code's point of view, but I think shadowing is a bad thing and renaming avoids it and also doesn't emit a warning, if you compile with -Wshadow.

In php-fpm.conf.in was a typo (syslog_syslog_level -> slowlog_syslog_level).

Four more questions regarding the patch:
1)
Is there a particular reason, why the facility names are partially compared with strcasecmp and strcmp? I found it confusing, that I have to type LOCAL6 instead of local6.

2)
When looking at php_syslog.h - for maximum portability, shouldn't the syslog() calls be changed to php_syslog()?

3)
I'm unsure - but aren't we losing messages from libevent written to stderr in the master process? I think one could use the fpm event system, to catch stderr, but didn't investigate further yet.

4)
Are you planning to integrate this patch into SVN?


Oh and besides the issues I mentioned - the patch works fine for me. :-)

Regards,
Edgar

Thanks for the reporting. I'll check that and answer you as soon as possible.

some answers to your questions:

1- this is a bug. All comparaison should use strcasecmp so that users can type 
facilities and log level with the case they want.

2- you're right. php_syslog() should be used instead of syslog()

4- after testing and validating, yes of course.

I need to take time reviewing all this. Thx again !

Hi Jerome,

are there any updates on this issue yet? With PHP 5.3.4 and PHP 5.3.5 the latest patch doesn't work anymore.

I'd be willing to port it to the latest release, if you're interested. I'd still like to see this integrated into trunk and 5.3.X.

Regards,
Edgar

Hi,

added a new patch, which can be applied to a vanilla PHP 5.3.5.

compiles and runs with:
--enable-debug without relevant warnings
--enable-maintainer-zts
without other flags
with having HAVE_SYSLOG_H in main/php_config.h undefined

changes:
* modified patch to work with FPM in 5.3.5
* added new parameters to config dump (todo: translate syslog prio and facility to nice human-readable values)
* made comparing syslog facilities case-insensitive
* replaced syslog() calls with php_syslog()

Regards,
Edgar

thx for the up to date patch. But there is still a remaining problem:

php_syslog(), openlog() and closelog() can be called from FPM code, core code, 
user script, module, sapi, ... 

If two calls to openlog() are made from two different places. Then this is not 
sure than php_syslog() will log the right ident and facility.

This a global reflection to make around PHP and not only in FPM.

I'm working on it.

Oh you're right. We're actually experiencing this issue here.

At least the master process should always log to the configured ident/facility - that's configuration and process manager warnings/errors. By far the most important log output from FPM, IMHO.

I don't think this is a critical issue for FPM, as log output is never discarded and other sapis (milter, thttpd, mod_php with Apache ErrorLog set to syslog) do it the same way - although it would be nice to see this resolved. I still wonder how to properly do this... open a separate socket and mimic syslog behaviour? How to address this on Windows?

If you have updates, I'd be really curious. If I can help, let me know. :-)

As a small fix to this, I just noticed that in 5.3.5, PHP-FPM logs correctly to 
the syslog, but the syslog tag is incorrect.

If for example you have a pool named "www" it will log to syslog like so:
2011-02-15 13:28:09.172141-05:00 hostname w: PHP Warning:  ocierror() expects 
parameter 1 to be resource, null given in filename.php on line 177

Similarly if you have a longer pool name (poolname) it'll show up like so:
2011-02-15 13:28:09.172141-05:00 hostname olname: PHP Warning:  ocierror() 
expects parameter 1 to be resource, null given in filename.php on line 177

It seems to be chopping off the first 2 characters of the pool name when it 
reports the syslog tag/program name to syslog.

I would log everything under a consistent ident/facility myself.

Then you have all FPM stuff coming in one stream. If you want to split it up then 
you can use filters inside of whatever syslog tools you use.

$.02

I tried this out in a development snapshot for PHP 5.3.7, but found that calls to zlog() from children were not showing up in syslog.

The following change fixes the problem; let me know if you'd like me to upload a new version of the patch.

diff -up php-snap/sapi/fpm/fpm/fpm_stdio.c.syslog php-snap/sapi/fpm/fpm/fpm_st
dio.c
--- php-snap/sapi/fpm/fpm/fpm_stdio.c.syslog  2011-04-11 19:10:17.425036568 -0
400
+++ php-snap/sapi/fpm/fpm/fpm_stdio.c   2011-04-11 19:10:24.569131370 -0400
@@ -64,9 +64,9 @@ int fpm_stdio_init_child(struct fpm_work
 #endif
        {
                close(fpm_globals.error_log_fd);
+               fpm_globals.error_log_fd = -1;
+               zlog_set_fd(-1);
        }
-       fpm_globals.error_log_fd = -1;
-       zlog_set_fd(-1);
 
        if (wp->listening_socket != STDIN_FILENO) {
                if (0 > dup2(wp->listening_socket, STDIN_FILENO)) {

to allow syslog on children, we'll have to wait until 
https://bugs.php.net/bug.php?id=51118 is closed.

I've just commit a partial syslog support to 5.4 branch and trunk:

http://svn.php.net/viewvc?view=revision&sortby=date&revision=312950

I'll wait 5.3.7 is out before backporting this to 5.3 branch.

it's only a partial syslog support as only error_log can use syslog. Slowlog patch 
must wait for bug #51118 to be closed.

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

As nobody cares about syslog on PHP, I won't spend some more time with this. 
Sorry. I've done everyhting I could and it will stay this way unless someone 
starts to care about syslog support into core.

++ fat