0 Day Analytics – Error Log Module Developer Documentation

The Error Log Viewer is the primary module of the Advanced Analytics plugin. It reads the PHP error log file in reverse order (newest first), parses each entry into structured data, and renders them in a WordPress WP_List_Table at wp-admin/admin.php?page=advan_logs.

Key Capabilities

• Reverse-reading of the PHP error log with memory and time safety limits
• Regex-based parsing of log lines into structured entries with severity, timestamp, source, and stack traces
• Severity-based colour-coded filtering with per-type toggle and single-severity mode
• Text search across messages and stack traces
• Plugin/theme source detection by matching error file paths to installed plugins and themes
• Source code viewing in a modal with syntax highlighting (SyntaxHighlighter library)
• CSV export with batched processing and progress tracking
• Log file download with HTTP Range support for resumable downloads
• Log truncation (full clear or keep last N records) with scheduled cron-based auto-truncation
• Admin bar live notifications via REST API
• Browser push notifications with configurable polling interval
• New error tracking via transients with menu badge count

Technology Stack

• PHP 7.4+ (strict types)
• WordPress WP_List_Table API
• WordPress REST API (namespace 0-day/v1)
• WordPress AJAX API
• SyntaxHighlighter for source code viewing
• Browser Notification API for push notifications
• Web Share API for error sharing

advanced-analytics/
├── classes/
│   └── vendor/
│       ├── lists/
│       │   ├── class-logs-list.php                — Main WP_List_Table (data read, parse, render)
│       │   ├── class-abstract-list.php            — Base abstract WP_List_Table class
│       │   ├── views/
│       │   │   └── class-logs-list-view.php       — Page rendering & page_load handler
│       │   └── traits/
│       │       └── class-list-trait.php           — Screen options, per-page, column mgmt
│       ├── controllers/
│       │   ├── class-error-log.php                — Log file autodetection, clear, truncate
│       │   ├── class-reverse-line-reader.php      — Reverse file reader with memory safety
│       │   └── api/
│       │       └── class-endpoints.php            — REST API route registration
│       └── helpers/
│           ├── class-log-line-parser.php          — Log line regex parser
│           ├── class-ajax-helper.php              — All AJAX endpoint handlers
│           ├── class-settings.php                 — Options, menus, admin bar, notifications
│           ├── class-file-helper.php              — File download, streaming, size formatting
│           ├── class-plugin-theme-helper.php      — Error source detection (plugin/theme)
│           ├── class-wp-error-handler.php         — Shutdown handler, Slack/Telegram alerts
│           └── class-miscellaneous.php            — Utility functions
├── js/
│   ├── admin/
│   │   └── endpoints.js                           — Admin bar live notification via REST API
│   ├── admin-export-csv.js                        — Batched CSV export with progress
│   └── sh/
│       ├── scripts/
│       │   ├── shCore.js                          — SyntaxHighlighter core
│       │   └── shBrushPhp.js                      — PHP syntax brush
│       └── styles/
│           ├── shCore.css                         — SyntaxHighlighter core styles
│           └── shThemeDefault.css                 — Default theme
└── css/
    ├── admin/
    │   └── style.css                              — Admin page styles
    └── admin-export-csv.css                       — Export progress bar styles

The main list table class. Extends Abstract_List (which extends WP_List_Table). Orchestrates data fetching, parsing, filtering, and rendering of the error log entries.

Constants

<?php
public const PAGE_SLUG           = 'toplevel_page_advan_logs';
public const SCREEN_OPTIONS_SLUG = 'advanced_analytics_logs_list';
public const SEARCH_INPUT        = 'sgp';

Key Methods

Handles the rendering of the error log viewer admin page and the page_load() processing.

Public Static Methods

Controls all operations on the error log file: autodetection, clearing, truncation, and file metadata.

Public Static Methods

Autodetection Logic

The autodetect() method determines the log file path with this sequence:

1. If keep_reading_error_log setting is OFF (default): requires both WP_DEBUG and WP_DEBUG_LOG constants to be true
2. If keep_reading_error_log setting is ON: bypasses the WP_DEBUG/WP_DEBUG_LOG checks
3. Reads ini_get('error_log') for the file path
4. Validates: error logging is enabled, path is absolute, file exists, is readable, and is writable
5. Returns the path string on success or a WP_Error on failure

WP_Error Codes

Reads the error log file backwards (from end to beginning) for efficient display of newest entries first.

Constants

<?php
private const BUFFER_SIZE        = 16384;  // 16 KB read buffer (adaptive)
private const MEMORY_LIMIT_MB    = 32;     // Stop if memory exceeds 32 MB
private const TIME_LIMIT_SECONDS = 25;     // Stop after 25 seconds
private const MAX_COLLECTED_ITEMS = 1000;  // Max entries to collect

Key Methods

Safety Mechanisms

• Memory guard: Terminates if memory usage exceeds MEMORY_LIMIT_MB (32 MB); creates disk overflow file at 80% of limit
• Time guard: Terminates after TIME_LIMIT_SECONDS (25 seconds)
• Item limit: Stops collecting after MAX_COLLECTED_ITEMS (1,000 entries)
• Buffer strategy: Uses php://memory for in-memory buffer, spills to php://temp and disk overflow files when needed
• HTML escaping: Each line is esc_html() escaped before being written to the temp buffer

Parses individual PHP error log lines into structured arrays using regex pattern matching.

Key Methods

Parsed Line Structure

<?php
$parsed_line = array(
    'timestamp'  => '2026-04-03 10:30:00',  // Parsed via strtotime()
    'severity'   => 'error',                 // Lowercase severity name
    'source'     => 'PHP',                   // Origin: PHP, WordPress database, REST API, WP_Error
    'message'    => 'Undefined variable $foo in /path/to/file.php on line 42',
    'error_file' => '/path/to/file.php',     // Extracted source file path
    'error_line' => 42,                      // Error line number
    'isContext'  => false,                   // Whether line contains [ELM_context_*] tags
    'sub_items'  => array(),                 // Stack trace frames (if present)
);

Recognized Severity Types

The parser detects the following severity levels from log lines: error, warning, notice, fatal, deprecated, parse, user, info, success, request, rest_no_route, rest_forbidden, not set.

Stack Trace Parsing

Stack trace frames follow the format #N path(line): call(). The parser handles:

• Standard frames with file paths and line numbers
• PHAR archive paths
• Windows drive letters (e.g., C:\path)
• Internal PHP functions ([internal function])
• {main} entries
• Truncated / partial stack traces

Registers and handles all AJAX endpoints for the Error Log Viewer module.

Registered Actions

Manages plugin options, admin menu registration, admin bar live notifications, and asset enqueuing.

Key Methods

Provides secure file download with streaming, path validation, and download link generation.

Key Methods

Security Measures

• All download paths validated against WP_CONTENT_DIR base via realpath()
• Symlinks are blocked
• Proper response headers: Content-Disposition, X-Content-Type-Options: nosniff, Cache-Control: private, no-store

Matches error file paths against installed plugins and themes to identify the source of errors.

Key Methods

Additionally detects WP Core (wp-includes/) and WP Admin Core (wp-admin/) paths.

Registers a PHP shutdown handler and a doing_it_wrong handler. Supports Slack and Telegram notifications on fatal errors.

Key Features

• Shutdown handler catches fatal errors via error_get_last()
• doing_it_wrong handler logs WordPress-specific developer misuse warnings
• Sensitive data redaction: passwords, tokens, cookies, and other secrets are redacted from error messages via redact_data()
• Optional Slack and Telegram notification support for real-time alerting

Page Load Sequence

1. admin_menu hook → Settings::add_options_page() registers the top-level menu at position 3
2. load-toplevel_page_advan_logs hook → Logs_List_View::page_load() processes query params, registers screen options
3. Page render → Logs_List_View::render() is called
4. Capability check: current_user_can('manage_options')
5. Error_Log::autodetect() determines the log file path (or returns WP_Error)
6. Logs_List::prepare_items() orchestrates data fetching
7. Logs_List::get_error_items() invokes the reverse reader
8. Reverse_Line_Reader::read_file_from_end() reads the log file backwards
9. Each line is parsed by Log_Line_Parser::parse_php_error_log_line()
10. Severity filter, search filter, and plugin filter are applied
11. Results are paginated and rendered via WP_List_Table

Log Line Processing Pipeline

Raw log file
    │
    ▼
Reverse_Line_Reader::read_file_from_end()
    │  (reads backwards, 16 KB buffer)
    ▼
Log_Line_Parser::parse_php_error_log_line()
    │  (regex: [timestamp] Source Severity: message)
    ├── Extracts: timestamp, severity, source, message, error_file, error_line
    ├── Detects stack traces → parse_php_error_log_stack_line()
    └── Groups sub_items under parent error
    │
    ▼
Plugin_Theme_Helper::get_plugin_from_file_path()
    │  (matches error file to installed plugins/themes)
    ▼
Severity filter (enabled/disabled severities)
    │
    ▼
Search filter (strpos on message + sub_items)
    │
    ▼
Plugin filter (match plugin field)
    │
    ▼
Logs_List::format_column_value()
    │  (renders HTML for each column)
    ▼
WP_List_Table display

All endpoints are registered under namespace 0-day/v1 and require manage_options capability.

Permission Callback

<?php
// All endpoints use this permission check:
public static function check_permissions(): bool {
    return current_user_can( 'manage_options' );
}

Example: Fetch Last Error via REST API

wp.apiFetch( { path: '/0-day/v1/live/get_last_item' } )
    .then( function( response ) {
        console.log( 'Last error:', response );
    } );

Example: Toggle Severity

// Disable "warning" severity
wp.apiFetch( { path: '/0-day/v1/severity/warning/disable/' } )
    .then( function() {
        location.reload();
    } );

// Show only "fatal" errors
wp.apiFetch( { path: '/0-day/v1/single_severity/fatal/' } )
    .then( function() {
        location.reload();
    } );

// Reset to show all severities
wp.apiFetch( { path: '/0-day/v1/single_severity/none_selected/' } )
    .then( function() {
        location.reload();
    } );

All AJAX actions require nonce verification and manage_options capability.

Example: Truncate Log via AJAX

jQuery.post( ajaxurl, {
    action: 'advanced_analytics_truncate_log_file',
    _wpnonce: advancedAnalytics.nonce  // 'advan-plugin-data' nonce
}, function( response ) {
    if ( response.success ) {
        location.reload();
    }
} );

Actions ACTION

AJAX Actions AJAX

Filters FILTER

Example: Change the Allowed Download Base Directory

<?php
\add_filter( '0-day-analytics_download_base_dir', function( $base_dir ) {
    // Allow downloads from /var/log/ as well
    return '/var/log';
} );

Example: Add a Custom Cron Job

<?php
\add_filter( 'advan_cron_hooks', function( $crons ) {
    $crons['my_custom_log_task'] = array(
        'schedule' => 'daily',
        'callback' => 'my_custom_log_handler',
    );
    return $crons;
} );

function my_custom_log_handler() {
    // Custom log processing logic
}

All settings are stored in the 0-day-analytics_options option in the WordPress wp_options table.

Reading Settings Programmatically

<?php
use ADVAN\Helpers\Settings;

// Get a specific option value
$keep_reading = Settings::get_option( 'keep_reading_error_log' );
$records_keep = Settings::get_option( 'keep_error_log_records_truncate' );
$auto_clear   = Settings::get_option( 'advana_error_log_clear' );
$severities   = Settings::get_option( 'severities' );

Error Log Options

Notification Options

General Options

Severity Configuration

The severities option stores an associative array of severity types. Each entry has:

<?php
$severities = array(
    'deprecated'     => array( 'name' => 'Deprecated',     'color' => '#c4b576', 'display' => true ),
    'error'          => array( 'name' => 'Error',          'color' => '#ffb3b3', 'display' => true ),
    'success'        => array( 'name' => 'Success',        'color' => '#00ff00', 'display' => true ),
    'info'           => array( 'name' => 'Info',           'color' => '#aeaeec', 'display' => true ),
    'notice'         => array( 'name' => 'Notice',         'color' => '#feeb8e', 'display' => true ),
    'warning'        => array( 'name' => 'Warning',        'color' => '#ffff00', 'display' => true ),
    'fatal'          => array( 'name' => 'Fatal',          'color' => '#f09595', 'display' => true ),
    'parse'          => array( 'name' => 'Parse',          'color' => '#e3bb8d', 'display' => true ),
    'user'           => array( 'name' => 'User',           'color' => '#85b395', 'display' => true ),
    'not set'        => array( 'name' => 'Not Set',        'color' => '#7a6f72', 'display' => true ),
    'request'        => array( 'name' => 'Request',        'color' => '#759b71', 'display' => true ),
    'rest_no_route'  => array( 'name' => 'REST No Route',  'color' => '#759b71', 'display' => true ),
    'rest_forbidden' => array( 'name' => 'REST Forbidden', 'color' => '#759b71', 'display' => true ),
);

How New Error Tracking Works

1. When the log is read, Log_Line_Parser::store_last_parsed_timestamp() saves the newest entry’s timestamp to the advan_timestamp transient
2. On subsequent reads, entries newer than the stored timestamp are counted in advan_newer_lines
3. The menu badge displays this count via Settings::show_error_count()
4. When the user visits the Error Log page, the count resets
5. On log truncation, Log_Line_Parser::delete_last_parsed_timestamp() clears both transients

Capability Checks

Nonce Verification

Path Validation & File Security

• Error_Log::clear() — validates the filename matches the detected log via is_same_log_file() using realpath()
• File_Helper::download() — validates path against WP_CONTENT_DIR base, blocks symlinks
• File_Helper::write_to_file() — validates against allowed base directory, blocks symlinks
• Source viewer — is_file_valid_php() check, config file protection via protected_config_source setting
• Reverse_Line_Reader::set_temp_handle_from_file_path() — rejects null bytes, non-file schemes, validates directory existence/writability, resolves realpath()

Input Sanitization

• Search input: sanitize_text_field() + wp_unslash()
• Plugin filter: validated against Plugin_Theme_Helper::get_plugins_bases() whitelist
• Severity names: validated against Settings::get_option('severities') keys
• File names in source viewer: validated as valid PHP file
• Browser notifications JS: sanitize_field() strips <> and newlines, isSafeUrl() validates HTTPS protocol
• Export data: content pre-escaped with esc_html()
• Sensitive data in errors: redacted via WP_Error_Handler::redact_data() (passwords, tokens, cookies, etc.)

Admin Bar Live Notifications

File: js/admin/endpoints.js

• Calls GET /0-day/v1/live/get_last_item via wp.apiFetch once on DOM ready
• Updates the admin bar node #wp-admin-bar-aadvan-menu with the latest error message and severity styling

Browser Push Notifications

Inline in class-settings.php

• Uses the browser Notification API with configurable poll interval (browser_notifications_seconds)
• Polls AJAX endpoint aadvana_get_notification_data at the configured interval
• Shows notification with error severity, message, plugin icon, and clickable link to the log page
• Notifications auto-dismiss after 5 seconds
• Deduplication via aadvan_notification site transient

Severity Toggle

Inline in class-logs-list.php

• Checkbox toggles call REST API severity/{name}/{enable|disable} then location.reload()
• Single severity dropdown calls REST API single_severity/{name}/

Log Management Actions

Inline in class-logs-list.php

• Truncate: Confirm dialog, then AJAX POST to advanced_analytics_truncate_log_file, reloads page
• Truncate & Keep: Same pattern with advanced_analytics_truncate_and_keep_log_file
• Download: Creates a temporary <a> element pointing to File_Helper::download_link()
• Copy to clipboard: Clicking clipboard icon copies error message + stack trace to clipboard
• Share: Uses navigator.share() API (Web Share API) when available
• Show details: Toggles .log_details_show div for stack trace expansion

CSV Export

File: js/admin-export-csv.js

• Batched export with progress bar and cancel support
• Posts to aadvana_export_large_csv with batch number, batch_size (default 500), and filter params
• Cleanup via aadvana_export_large_csv_cleanup after download (delayed 10 seconds)

Raw Log View

Inline in class-logs-list.php

• Raw log content displayed in <pre id="debug-log"> block (black background, white text, max-height 400px, scrollable)
• Selecting text in this block auto-copies to clipboard with tooltip feedback

Dark Skin Toggle

• Checks localStorage.getItem('aadvana-backend-skin') for 'dark' value
• Adds aadvana-darkskin class to <html> element
• All severity-related styles have html.aadvana-darkskin overrides

Example 1: Autodetect the Error Log File

<?php
use ADVAN\Controllers\Error_Log;

$log_path = Error_Log::autodetect();

if ( is_wp_error( $log_path ) ) {
    echo 'Error: ' . $log_path->get_error_message();
    echo 'Code: ' . $log_path->get_error_code();
} else {
    echo 'Log file: ' . $log_path;
    echo 'Size: ' . Error_Log::get_file_size( $log_path ) . ' bytes';
    echo 'Last modified: ' . gmdate( 'Y-m-d H:i:s', Error_Log::get_modification_time( $log_path ) );
}

Example 2: Parse a Log Line

<?php
use ADVAN\Helpers\Log_Line_Parser;

$line = '[03-Apr-2026 10:30:00 UTC] PHP Warning: Undefined variable $foo in /var/www/html/wp-content/plugins/my-plugin/main.php on line 42';

$parsed = Log_Line_Parser::parse_php_error_log_line( $line );

if ( $parsed ) {
    echo 'Timestamp: ' . $parsed['timestamp'];   // 2026-04-03 10:30:00
    echo 'Severity: ' . $parsed['severity'];      // warning
    echo 'Source: ' . $parsed['source'];           // PHP
    echo 'Message: ' . $parsed['message'];
    echo 'File: ' . $parsed['error_file'];         // /var/www/.../main.php
    echo 'Line: ' . $parsed['error_line'];         // 42
}

Example 3: Identify Plugin from Error Path

<?php
use ADVAN\Helpers\Plugin_Theme_Helper;

$error_file = '/var/www/html/wp-content/plugins/woocommerce/includes/class-wc-cart.php';

$plugin_name = Plugin_Theme_Helper::get_plugin_from_file_path( $error_file );

if ( $plugin_name ) {
    echo 'Error originated from plugin: ' . $plugin_name;
} else {
    $theme_name = Plugin_Theme_Helper::get_theme_from_file_path( $error_file );
    if ( $theme_name ) {
        echo 'Error originated from theme: ' . $theme_name;
    } else {
        echo 'Source unknown or WP core';
    }
}

Example 4: Clear the Error Log Programmatically

<?php
use ADVAN\Controllers\Error_Log;

$log_path = Error_Log::autodetect();

if ( ! is_wp_error( $log_path ) ) {
    // Completely clear the log
    $cleared = Error_Log::clear( $log_path );

    if ( $cleared ) {
        echo 'Error log cleared successfully.';
    }

    // Or truncate keeping last 20 records
    // (uses the keep_error_log_records_truncate setting)
    Error_Log::truncate_and_keep_errors();
}

Example 5: Get the Last Error for External Monitoring

<?php
use ADVAN\Lists\Logs_List;

// Fetch the last error entry (same as the REST API endpoint)
$logs_list = new Logs_List();
$response  = $logs_list->extract_last_item();

$data = $response->get_data();

if ( ! empty( $data ) ) {
    echo 'Latest error severity: ' . $data['severity'];
    echo 'Latest error message: ' . $data['message'];
    echo 'Timestamp: ' . $data['timestamp'];
}

Example 6: Generate a Log File Download Link

<?php
use ADVAN\Helpers\File_Helper;
use ADVAN\Controllers\Error_Log;

$log_path = Error_Log::autodetect();

if ( ! is_wp_error( $log_path ) ) {
    $download_url = File_Helper::download_link( $log_path );
    echo '<a href="' . esc_url( $download_url ) . '">Download Error Log</a>';
}

Example 7: Check and Modify Severity Settings

<?php
use ADVAN\Helpers\Settings;

// Get all severity configurations
$severities = Settings::get_option( 'severities' );

// Check if a severity is enabled for display
if ( $severities['warning']['display'] ) {
    echo 'Warnings are visible in the log viewer.';
}

// Check notification settings
$admin_bar_enabled = Settings::get_option( 'live_notifications_admin_bar' );
$polling_interval  = Settings::get_option( 'browser_notifications_seconds' );
$notifications_off = Settings::get_option( 'browser_notifications_not_send' );

echo 'Admin bar notifications: ' . ( $admin_bar_enabled ? 'Enabled' : 'Disabled' );
echo 'Browser notification polling: every ' . $polling_interval . ' seconds';

Example 8: Customize the Download Base Directory

<?php
// Allow downloads from a custom log directory outside wp-content
\add_filter( '0-day-analytics_download_base_dir', function( $base_dir ) {
    return '/var/log/wordpress';
} );

// Allow file writes to a custom directory
\add_filter( '0-day-analytics_fs_base_dir', function( $base_dir ) {
    return '/var/log/wordpress';
} );

Example 9: Suppress Error Logging During Operations

<?php
use ADVAN\Controllers\Error_Log;

// Temporarily suppress PHP error logging
// (useful during operations that might produce expected errors)
Error_Log::suppress_error_logging();

// Perform operations that might trigger PHP errors...
@some_potentially_noisy_function();

// Re-enable error logging
Error_Log::enable_error_logging();