---
path: administration/action-history/php-fpm-logging.mdx
title: PHP-FPM logging
slug: php-fpm-logging
pagination_next: null
pagination_prev: null
description: >-
  Technical overview of stdout/stderr and error_log logging in PHP-FPM for
  correct Passwork Activity log event logging configuration.
keywords:
  - Passwork
  - PHP-FPM
  - master process
  - worker processes
  - catch_workers_output
  - error_log
  - stdout
  - stderr
  - SIEM
  - CEF
---

## PHP-FPM basic model

- **Master process** — manages the PHP-FPM pool and maintains the main `error_log`.
- **Worker processes** — handle Passwork FastCGI requests and produce PHP errors or warnings.

## `catch_workers_output`

Redirects worker output (`stdout` and `stderr`) to the master process stream or a log file. The destination is defined by the `error_log` parameter in the `php-fpm.conf` configuration file.

Possible values:

- `yes` — worker `stdout` and `stderr` are redirected to the stream or file defined in `error_log`;
- `no` (default) — worker output is redirected to `/dev/null` (per FastCGI specification).

This setting is commonly used in containerized environments to collect and forward events through `stdout`/`stderr` via `error_log`.

## `error_log`

The `error_log` parameter value (in `php-fpm.conf`) defines where PHP-FPM writes logs:

- file (for example, `/var/log/php-fpm.log`);
- `syslog` for forwarding to `syslogd`;
- stream (for example, `/dev/stderr`).

If `error_log` is directed to a stream (for example, `/dev/stderr` or `/proc/self/fd/2`), captured worker output is also sent to the container log stream.

## Activity log in Passwork

For **Activity log**, the `ACTIVITY_LOG_OUTPUT` parameter defines the output channel:

- `syslog` — writes action events via syslog;
- `stdout` — writes action events to the PHP-FPM stream.