How to Automate PHP Error Log Monitoring with Python

The real-world scenario

Imagine you are a DevOps Engineer managing a high-traffic **Laravel** or **WordPress** cluster. At 2 AM, a database connection begins to fail intermittently. The errors are silently piling up in **php_errors.log**. Unless you are manually running tail -f on five different servers, you will not know there is a problem until users start complaining on social media. This script acts like a digital security guard, watching your **PHP** logs and instantly notifying your team when a critical failure occurs.

The solution

We use **Python** and the pathlib module to create a persistent file watcher. The script monitors the end of a designated **PHP** log file, parses new lines for keywords like Fatal error or Parse error, and dispatches an alert to a **Slack** webhook. This ensures zero-latency awareness of production issues.

Prerequisites

• Install the requests library: pip install requests
• Ensure you have the path to your **php.ini** defined error log.
• A **Slack** Webhook URL for receiving notifications.

The code

"""
-----------------------------------------------------------------------
Authors: Sharanam & Vaishali Shah
Recipe: PHP Log Sentinel
Intent: Monitor PHP error logs in real-time and send Slack alerts.
-----------------------------------------------------------------------
"""
import time
import requests
import json
from pathlib import Path

# --- Configuration ---
LOG_FILE_PATH = Path("/var/log/php-fpm/www-error.log")
SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
KEYWORDS_TO_WATCH = ["Fatal error", "Parse error", "Uncaught Exception"]

def send_slack_alert(message):
    """Deliver a formatted alert to the Slack channel."""
    payload = {
        "text": f"🚨 *PHP Production Alert*n```{message}```",
        "username": "PHP Sentinel",
        "icon_emoji": ":fire:"
    }
    try:
        response = requests.post(
            SLACK_WEBHOOK_URL, 
            data=json.dumps(payload),
            headers={"Content-Type": "application/json"}
        )
        return response.status_code == 200
    except Exception as e:
        print(f"Failed to send alert: {e}")
        return False

def monitor_log():
    """Watch the log file for new entries and analyze them."""
    if not LOG_FILE_PATH.exists():
        print(f"Error: The file {LOG_FILE_PATH} does not exist.")
        return

    print(f"Monitoring {LOG_FILE_PATH} for critical PHP errors...")
    
    # Open file and move pointer to the end
    with open(LOG_FILE_PATH, "r") as f:
        f.seek(0, 2)
        
        while True:
            line = f.readline()
            if not line:
                # Sleep briefly to reduce CPU overhead
                time.sleep(0.5)
                continue
            
            # Check if line contains critical keywords
            if any(keyword in line for keyword in KEYWORDS_TO_WATCH):
                print(f"Critical error found: {line.strip()}")
                send_slack_alert(line.strip())

if __name__ == "__main__":
    try:
        monitor_log()
    except KeyboardInterrupt:
        print("nSentinel stopped by user.")

Code walkthrough

The script begins by importing **pathlib** to handle file paths across different environments reliably. We define the **LOG_FILE_PATH** using the **Path** object, which is more robust than standard string manipulation.

The core logic resides in the monitor_log function. Instead of reading the whole file (which could be gigabytes in size), we use f.seek(0, 2) to jump immediately to the end of the file. This ensures we only process new errors generated after the script starts.

Inside the while True loop, we use f.readline(). If no new data is found, the script pauses for 500 milliseconds using time.sleep to prevent high CPU utilization. When a new line appears, the script checks if any of our KEYWORDS_TO_WATCH exist in that string. If a match is found, the send_slack_alert function sends a JSON payload to your **Slack** workspace using the **requests.post** method.

Sample output

When you execute the script in your terminal, you will see the following:

Monitoring /var/log/php-fpm/www-error.log for critical PHP errors...
Critical error found: [25-Oct-2023 10:15:02 UTC] PHP Fatal error: Uncaught Error: Call to a member function get() on null in /var/www/html/index.php:12

Simultaneously, your **Slack** channel will receive a notification with the full stack trace snippet provided in the log line.

Conclusion

Proactive monitoring is the difference between a minor bug and a major outage. By using **Python** to bridge the gap between your **PHP** logs and your communication tools, you create a fail-safe environment. This script can be further enhanced by adding log rotation handling or filtering out repetitive duplicate errors.