Data Source: Apache Error Log

Created: 2026-10-22

Last Updated: 2026-10-23

ID: 4abf5ed1-29c9-4d57-8b1b-56cbd793557c

Author: Nasreddine Bencherchali, Raven Tait, Splunk

Description

Apache HTTP Server error log events including PHP runtime errors, client addresses, and proxy or PHP-FPM backend errors.

Details

Property	Value
Source	`/var/log/apache2/error.log`
Sourcetype	`apache:error`

Name ▲▼	Technique ▲▼	Type ▲▼
PHP Worker Segmentation Fault After Multipart POST	Exploit Public-Facing Application	Anomaly

Supported Apps

Splunk Add-on for Apache Web Server (version 3.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">error_code</span>
  
  <span class="pill kill-chain">error_message</span>
  
  <span class="pill kill-chain">error_port</span>
  
  <span class="pill kill-chain">file_path</span>
  
  <span class="pill kill-chain">module</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">req_time</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">threshhold_id</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1[Wed Oct 21 23:17:54.944504 2026] [php:error] [pid 50519:tid 50519] [client 10.3.99.1:44076] PHP Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 102400 bytes) in Unknown on line 0

Required Output Fields

src
process_id
error_message

Source: GitHub | Version: 2