PHPMonitor

The PHPMonitor is a small PHP script with has to be pre-prended to all other PHP scripts of a website. This can be done either manually (unreliable) or by configuring the php.ini file of a server appropriatly (not always possible). The script relies on a cookie for the user identification to be available thorugh the ​Apache module mod_usertrack.

<?php
  /*
   * Usage monitoring script for PHP web applications.
   * Requires the apache modules mod_usertrack to provide
   * a cookie for user identification.
   */
  $log_dir = dirname( __FILE__)."/";
  $log_name = "usage.log";
  $cookie_name = "swe_informatik_uni-goettingen_de";

  $postkeys = "";

  while (list($key, $value) = each($_POST)) {
    $postkeys = $postkeys." ".$key;
  }
  if( $_SERVER['HTTP_REFERER']=='' ) {
    $referer = '-';
  } else {
    $referer = $_SERVER['HTTP_REFERER'];
  }

  $cookieVal = $_COOKIE[$cookie_name];
  if($cookieVal==0) {
    $apacheHeader = apache_response_headers();
    $explodeResult1 = explode(';',$apacheHeader['Set-Cookie']);
    $explodeResult2 = explode('=',$explodeResult1[0]);
    $cookieVal = $explodeResult2[1];
  }

  $log_entry = "\"".$cookieVal."\" \"".gmdate('Y-m-d H:i:s')."\" \"".$_SERVER['REQUEST_URI']."\" \"".$referer."\" \"".$_SERVER['HTTP_USER_AGENT']."\" \"".$postkeys."\"\r\n";
  $fp=fopen( $log_dir . $log_name, 'a' );
  fputs($fp, $log_entry);
  fclose($fp);
?>

The resulting log files look as follows.

"172.20.0.9.1307611615198521" "2011-06-16 09:57:05" "/index.php?lang=de" "http://www.address.de/index.php?lang=de" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1)" ""
"172.20.0.9.1307611615198521" "2011-06-16 09:57:05" "/contentABC.php?lang=de" "http://www.address.de/index.php?lang=de" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1)" "postVar1"
"172.20.0.9.1307611615198521" "2011-06-16 09:57:05" "/contentABC.php?lang=de" "http://www.address.de/index.php?lang=de" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1)" "postVar1 postVar2"
"172.20.0.9.1307611615198521" "2011-06-16 09:57:05" "/contentXYZ.php?lang=de" "http://www.address.de/index.php?lang=de" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1)" "postVar2"