服务器PHP-FPM slowlog定时分析工具

request_slowlog_timeout = 5s  ; 执行超过5秒的请求触发日志
slowlog = /var/log/php-fpm/slow.log  ; 日志路径

[pool www] pid 12345 script_filename = /var/www/html/index.php
[0x7f8a1c3b5000] request_timeout() /var/www/html/index.php:10
[0x7f8a1c3b5000] sleep(3) /var/www/html/lib/utils.php:20

# 1. 安装GoAccess
sudo apt install goaccess  

# 2. 创建日志轮转脚本（每小时切割一次）
echo "0 * * * * /usr/bin/logrotate -f /etc/logrotate.d/php-fpm-slowlog" >> /etc/crontab

# 3. 配置logrotate（/etc/logrotate.d/php-fpm-slowlog）
/var/log/php-fpm/slow.log {
    hourly
    missingok
    rotate 24
    compress
    create 640 www-data adm
    sharedscripts
    postrotate
        /bin/kill -USR1 `cat /var/run/php/php7.x-fpm.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

# 4. 使用GoAccess分析日志
goaccess /var/log/php-fpm/slow.log -a --log-format=COMBINED -o report.html

input {
  file {
    path => "/var/log/php-fpm/slow.log"
    start_position => "beginning"
  }
}

filter {
  grok {
    match => { "message" => "%{WORD:pool} pid %{NUMBER:pid} script_filename = %{URIPATHPARAM:script} \[%{DATA:timestamp}\] %{GREEDYDATA:trace}" }
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "php-slowlog-%{+YYYY.MM.dd}"
  }
}

#!/bin/bash
LOG_FILE="/var/log/php-fpm/slow.log"
REPORT_FILE="/tmp/slowlog_report_$(date +%Y%m%d%H).txt"

# 提取脚本路径和耗时（假设日志格式为固定字段）
awk -F'script_filename = | \[| \]' '{print $2, $4}' "$LOG_FILE" | \
  awk '{print $1, $NF}' | \
  sort -k2 -nr | \
  head -10 > "$REPORT_FILE"

# 发送邮件（需配置mailutils）
if [ -s "$REPORT_FILE" ]; then
  echo "Top 10 Slow PHP Requests:" | mail -s "PHP Slowlog Alert" -A "$REPORT_FILE" admin@example.com
fi

# 清空旧日志（谨慎使用！建议用logrotate替代）
# > "$LOG_FILE"

echo "0 * * * * /bin/bash /path/to/slowlog_analyzer.sh" >> /etc/crontab

# 统计出现次数最多的脚本
awk '{print $2}' /var/log/php-fpm/slow.log | sort | uniq -c | sort -nr | head -5

120 /var/www/html/api/user/login.php
85 /var/www/html/admin/report/generate.php

# 查找包含"while(true)"或"for(;;)"的日志
grep -i "while(true)\|for(;;)" /var/log/php-fpm/slow.log

# 提取包含SQL的慢请求（需日志中记录了查询语句）
grep -i "select\|insert\|update\|delete" /var/log/php-fpm/slow.log