PHP syslog() not working

[danielkorte]

Centos 7.9 v94.0.10

rsyslogd 8.24.0-57.el7_9, compiled with:
PLATFORM: x86_64-redhat-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64

PHP application is set to use LOG_LOCAL3

php.ini (PHP 7.4.19) has `error_log = syslog`

/etc/rsyslog.conf

$ModLoad imuxsock
$ModLoad imjournal
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log

/etc/rsyslog.d/30-custom-logs.conf — I’m using two locations in case there are any permissions issues

local3.* -/home/USERNAME/logs/php.log
local3.* -/var/log/php.log

 

[cPRex]

Hey there! I would expect the configurations you've listed to work properly, as that all looks standard.

I did find there could be issues with FPM related to syslog: PHP :: Bug #79342 :: Syslog broken on FPM since PHP 7.3.0

Are you using PHP-FPM for that domain? If so, can you try switching that off to see if that changes the behavior?

 

[danielkorte]

Hey! Thanks for your response, but no, PHP-FPM is disabled on the server.

I looked into it a bit further, and it seems that my non-root user can't use syslog (I’m guessing a permissions thing). When I use the logger command with that user nothing happens, but if I use logger with the root user everything works. But PHP seems to run as the non-root user.

 

[cPRex]

That's a really good point too! It looks like other users have come up with creative ways to work around that restriction, such as custom user groups, but I'm not sure if you want to try that on the machine or not:

How to grant non-root user access only to /var/log directory

I have newly created non-root(normal) user and want to grant access only to /var/log directory so that the user can view and monitor the logs. The user should not be able to cd/ls or access the /etc

askubuntu.com

 

[danielkorte]

Yeah, I’d like to avoid that. That's why I was using the /home/USERNAME/logs/ path which the non-root user should have access to. Permissions shouldn't be an issue. It seems as if the logger command isn’t communicating with rsyslog since I can't get any messages to any file/path.

 

[cPRex]

I don't personally have any other ideas on my end, but you're always welcome to submit a ticket to our team and we could do some testing with your specific environment.