PHP-FPM

This Elastic integration collects metrics from PHP-FPM.


Version	1.2.1 (View all)
Compatible Kibana version(s)	8.7.1 or higher
Supported Serverless project types What's this?	Security Observability
Subscription level What's this?	Basic
Level of support What's this?	Elastic

Overview

PHP-FPM (FastCGI Process Manager) is a web tool used to speed up the performance of a website. It is much faster than traditional CGI based methods and has the ability to handle tremendous loads simultaneously.

Use the PHP-FPM integration to:

Collect metrics related to the pool and process.
Create visualizations to monitor, measure, and analyze usage trends and key data, deriving business insights.
Create alerts to reduce the MTTD and MTTR by referencing relevant logs when troubleshooting an issue.

Data streams

The PHP-FPM integration collects metrics data.

Metrics provide insight into the statistics of the PHP-FPM. The Metrics data streams collected by the PHP-FPM integration include pool and process so that the user can monitor and troubleshoot the performance of the PHP-FPM instances.

Data streams:

pool: Collects information related to the connection handling, queue metrics, process manager configuration, process activity and performance indicators.
process: Collects information related to the request metrics, the latest CPU and memory usage and the current running state.

Note:

Users can monitor and view the metrics inside the ingested documents for PHP-FPM in the logs-* index pattern in Discover.

Compatibility

This integration has been tested against v8.2 and v8.1 standalone versions of PHP-FPM.

Requirements

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

In order to ingest data from PHP-FPM, you must know the host(s) and status path of the PHP-FPM instance.

Host configuration format: http[s]://host[:port]

Example host configuration: http://localhost:8080

Status path configuration format: /path

Example Status path configuration: /status

Setup

For step-by-step instructions on how to set up an integration, see the Getting Started guide.

Validation

After successfully configuring the integration, click on the Assets tab of the PHP-FPM integration to display the available dashboards. Select the dashboard for your configured data stream, which should be populated with the required data.

Troubleshooting

If host.ip appears conflicted under the logs-* data view, this issue can be resolved by reindexing the indices of the Pool and Process data streams.

Metrics reference

Pool

The pool data stream collects metrics related to the setup and contents of the FPM status page.

An example event for pool looks as following:

{
    "@timestamp": "2023-07-28T10:10:15.918Z",
    "agent": {
        "ephemeral_id": "9581f949-002c-4a1f-8939-abae313a3e55",
        "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.7.1"
    },
    "data_stream": {
        "dataset": "php_fpm.pool",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.4.0"
    },
    "elastic_agent": {
        "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac",
        "snapshot": false,
        "version": "8.7.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web",
            "configuration",
            "process"
        ],
        "created": "2023-07-28T10:10:15.918Z",
        "dataset": "php_fpm.pool",
        "ingested": "2023-07-28T10:10:19Z",
        "kind": "event",
        "module": "php_fpm",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "php_fpm": {
        "pool": {
            "connections": {
                "accepted": 1,
                "listen_queue": {
                    "max_size": 128,
                    "requests": {
                        "max": 0
                    }
                },
                "queued": 0
            },
            "name": "www",
            "process_manager": {
                "type": "ondemand"
            },
            "processes": {
                "active": {
                    "count": 1,
                    "max": 1
                },
                "children_reached": {
                    "max": 0
                },
                "count": 1,
                "idle": 0
            },
            "slow_requests": 0,
            "start_since": 17,
            "start_time": 1690538998
        }
    },
    "service": {
        "address": "http://elastic-package-service_php_fpm_1"
    },
    "tags": [
        "php_fpm-pool",
        "forwarded"
    ]
}

Exported fields

Field	Description	Type	Unit	Metric Type
@timestamp	Event timestamp.	date
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
ecs.version	ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.	keyword
error.message	Error message.	match_only_text
event.category	This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories.	keyword
event.dataset	Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.	keyword
event.ingested	Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.	date
event.kind	This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.	keyword
event.module	Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.	keyword
event.type	This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types.	keyword
host.ip	Host ip addresses.	ip
input.type	Type of Filebeat input.	keyword
php_fpm.pool.connections.accepted	The total number of accepted connections.	long		counter
php_fpm.pool.connections.listen_queue.max_size	The maximum allowed size of the listen queue.	long		gauge
php_fpm.pool.connections.listen_queue.requests.max	The maximum number of requests seen in the listen queue at any one time.	long		gauge
php_fpm.pool.connections.queued	The number of requests (backlog) currently waiting for a free process.	long		gauge
php_fpm.pool.name	The name of the FPM process pool.	keyword
php_fpm.pool.process_manager.type	The process manager type - static, dynamic or ondemand.	keyword
php_fpm.pool.processes.active.count	The number of processes that are currently processing requests.	long		gauge
php_fpm.pool.processes.active.max	The maximum number of concurrently active processes.	long		gauge
php_fpm.pool.processes.children_reached.max	Has the maximum number of processes ever been reached? If so the displayed value is 1 otherwise the value is 0.	long		gauge
php_fpm.pool.processes.count	The current total number of processes.	long		gauge
php_fpm.pool.processes.idle	The number of processes that are currently idle (waiting for requests).	long		gauge
php_fpm.pool.slow_requests	The total number of requests that have hit the configured request_slowlog_timeout.	long		counter
php_fpm.pool.start_since	The time in seconds since the process pool was last started.	long	s	counter
php_fpm.pool.start_time	The date/time that the process pool was last started.	long
service.address	Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).	keyword
tags	List of keywords used to tag each event.	keyword

Process

The process data stream collects metrics related to the request duration, content length, process state, etc.

An example event for process looks as following:

{
    "@timestamp": "2023-07-28T10:11:12.080Z",
    "agent": {
        "ephemeral_id": "0f5589f7-327f-468e-b368-00ada3a96721",
        "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.7.1"
    },
    "data_stream": {
        "dataset": "php_fpm.process",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.4.0"
    },
    "elastic_agent": {
        "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac",
        "snapshot": false,
        "version": "8.7.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web",
            "configuration",
            "process"
        ],
        "created": "2023-07-28T10:11:12.080Z",
        "dataset": "php_fpm.process",
        "ingested": "2023-07-28T10:11:15Z",
        "kind": "event",
        "module": "php_fpm",
        "type": [
            "info"
        ]
    },
    "http": {
        "request": {
            "body": {
                "bytes": 0
            },
            "method": "GET"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "php_fpm": {
        "process": {
            "pool": {
                "name": "www"
            },
            "request": {
                "count": 1,
                "duration": 581,
                "last": {
                    "cpu": {
                        "pct": 0
                    },
                    "memory": 0
                }
            },
            "script": "-",
            "start_since": 0,
            "start_time": 1690539072,
            "state": "Running"
        }
    },
    "process": {
        "pid": 33
    },
    "service": {
        "address": "http://elastic-package-service_php_fpm_1"
    },
    "tags": [
        "php_fpm-process",
        "forwarded"
    ],
    "url": {
        "original": "/status?json\u0026full"
    },
    "user": {
        "name": "-"
    }
}