syslog

If anyone is wondering why their log messages are appearing in multiple log files, here is one answer applying to *nix systems:

If your syslog.conf looks like this (assuming you use LOG_LOCAL0 for web app logging) :

local0.info    /var/log/web/info.log

This will collect *all* messages of LOG_INFO level and higher, i.e everything except debug messages

Try this instead to ensure that only messages of the named log level go into the relevant log file:

local0.=info    /var/log/web/info.log

Additionally, you may like to add this to ensure your messages don't end up in generic log files like "messages"  "all" "syslog" and "debug":

local0.none    /var/log/messages
local0.none    /var/log/debug
etc

saves disk space among other things - more at "man syslog.conf"

This function sends messages in BSD Syslog RFC 3164 format (https://tools.ietf.org/html/rfc3164).

To see the raw messages being sent by PHP to the logging socket, first stop your syslog/rsylsog/ng-syslog service, then listen to the logging socket with the netcat-openbsd package:

nc -U -l /dev/log

Now, log something from PHP:

<?php
syslog(LOG_LOCAL1|LOG_INFO, "Test from PHP");
?>

You will see the rfc3164 output from netcat:

<142>Oct 24 14:32:51 php: Test from PHP

Syslog autodetects newline control characters and therefore splits the message by multiple lines. To prevent this behavior in PHP 7.3+ you can use undocumented (at this moment) ini setting:

<?php

ini_set('syslog.filter', 'raw');

# more info here: https://bugs.php.net/bug.php?id=77913

A word of warning; if you use openlog() to ready syslog() and your Apache threads accept multiple requests, you *must* call closelog() if Apache's error log is configured to write to syslog.  Failure to do so will cause Apache's error log to write to whatever facility/ident was used in openlog.

Example, in httpd.conf you have:

ErrorLog syslog:local7

and in php you do:

<?php
openlog("myprogram", 0, LOG_LOCAL0);
syslog("My syslog message");
?>

From here on out, this Apache thread will write ErrorLog to local0 and under the process name "myprogram" and not httpd!  Calling closelog() will fix this.