Php-cgi -v zombie process resulting from collectinfo.pl

Hi all.

Having a problem. Almost once a day, the collectinfo.pl script leaves a zombie “php-cgi -v” call running.

Here’s an example of the process:

USER             PID  %CPU %MEM     VSZ     RSS TT  STAT STARTED      TIME COMMAND
root           45223 100.0  0.0   71224   56176  -  RJ   14:33     23:40.21 /usr/local/bin/php-cgi -v

Here’s the output of procstat:

procstat -f 45223
  PID COMM                FD T V FLAGS    REF  OFFSET PRO NAME        
45223 php-cgi           text v r r-------   -       - -   /usr/local/bin/php-cgi
45223 php-cgi            cwd v d r-------   -       - -   /usr/local/lib/webmin/virtual-server
45223 php-cgi           root v d r-------   -       - -   /                 
45223 php-cgi           jail v d r-------   -       - -   /                 
45223 php-cgi              0 v c r-------   1       0 -   /dev/null         
45223 php-cgi              1 p - rw------   2       0 -   -                 
45223 php-cgi              2 p - rw------   2       0 -   -                 
[root@gaudete:/var/log/webmin]# 

SYSTEM INFORMATION
OS type and version FreeBSD 13.1-RELEASE-p6 on amd64
Webmin version 2.013
Virtualmin version 7.2
Perl version 5.036000
Path to Perl /usr/local/bin/perl
Python version 3.11.2
Path to Python /usr/local/bin/python3
BIND version 9.18
Postfix version 3.8-20230213
Mail injection command /usr/sbin/sendmail -t
Apache version 2.4.56
PHP versions 8.2.4
Webalizer version 2.23-08
Logrotate version 3.13.0
MySQL version 8.0.32
SpamAssassin version 4.0.0

I have the full debug log from the above process, too big to paste.
It may come from one of the following lines:

65375 [31/Mar/2023 14:33:03.560944] - - virtual-server READ "/usr/local/etc/webmin/net/module.info.override"
65375 [31/Mar/2023 14:33:03.561253] - - net READ "/etc/defaults/rc.conf"
65375 [31/Mar/2023 14:33:03.564485] - - net READ "/etc/rc.conf"
65375 [31/Mar/2023 14:33:03.565594] - - virtual-server CMD "cmd=/usr/local/bin/python3 --version 2>&1"
65375 [31/Mar/2023 14:33:03.580585] - - virtual-server CMD "cmd=/usr/local/bin/ -v 2>&1 </dev/null"
65375 [31/Mar/2023 14:33:03.589625] - - virtual-server CMD "cmd=/usr/local/bin/php-cgi -v 2>&1 </dev/null"
65375 [31/Mar/2023 14:33:03.678183] - - virtual-server CMD "cmd=/usr/local/bin/php-cgi -v 2>&1 </dev/null"
36502 [01/Apr/2023 14:33:03.472999] - - virtual-server READ "/usr/local/etc/webmin/net/module.info.override"
36502 [01/Apr/2023 14:33:03.473289] - - net READ "/etc/defaults/rc.conf"
36502 [01/Apr/2023 14:33:03.476509] - - net READ "/etc/rc.conf"
36502 [01/Apr/2023 14:33:03.477620] - - virtual-server CMD "cmd=/usr/local/bin/python3 --version 2>&1"
36502 [01/Apr/2023 14:33:03.492392] - - virtual-server CMD "cmd=/usr/local/bin/ -v 2>&1 </dev/null"
36502 [01/Apr/2023 14:33:03.501311] - - virtual-server CMD "cmd=/usr/local/bin/php-cgi -v 2>&1 </dev/null"
36502 [01/Apr/2023 14:33:03.589026] - - virtual-server CMD "cmd=/usr/local/bin/php-cgi -v 2>&1 </dev/null"

One insight – the entire process appears to have run twice.

This has happened again today, with the debug log on.

The information in debug is limited at best.


root           52627 100.0  0.0   71224   56176  -  RJ   11:13    113:49.36 /usr/local/bin/php-cgi -v
procstat -f 52627
  PID COMM                FD T V FLAGS    REF  OFFSET PRO NAME        
52627 php-cgi           text v r r-------   -       - -   /usr/local/bin/php-cgi
52627 php-cgi            cwd v d r-------   -       - -   /usr/local/lib/webmin/virtual-server
52627 php-cgi           root v d r-------   -       - -   /                 
52627 php-cgi           jail v d r-------   -       - -   /                 
52627 php-cgi              0 v c r-------   1       0 -   /dev/null         
52627 php-cgi              1 p - rw------   2       0 -   -                 
52627 php-cgi              2 p - rw------   2       0 -   -

242339 [03/Apr/2023 11:13:02.065111] - - virtual-server CMD "cmd=/usr/local/bin/php-cgi -v 2>&1 </dev/null"

Clearing these out by hand regularly. Seeking advice on how not to make them.

root            6810 100.0  0.0   71224   56176  -  RJ   Tue14    2671:33.85 /usr/local/bin/php-cgi -v
root           31730 100.0  0.0   71224   56176  -  RJ   Tue02    3411:35.19 /usr/local/bin/php-cgi -v
root           52627 100.0  0.0   71224   56176  -  RJ   Mon11    4311:34.48 /usr/local/bin/php-cgi -v
root           62812 100.0  0.0   71224   56176  -  RJ   Tue14    2691:35.15 /usr/local/bin/php-cgi -v

Not every collectinfo run causes a zombie, it’s only one or two per day, but from the logs, timestamps and system information calls, they are clearly coming from virtualmin./webmin and collectinfo.

Please assist if possible.

Hello,

What makes you think that it happens because of collectinfo.pl run?

Also, what is /usr/local/bin/php-cgi file? Because running php-cgi -v should be harmless and very fast.

You can check more about /usr/local/bin/php-cgi file by running:

stat /usr/local/bin/php-cgi
  1. this happens at exactly 13, 33, or 53 minutes after an hour in all cases, the only running process in virtualmin/webmin or on any process is the collectinfo.pl - although somewhat circumstantial at first it was the first clue. After dozens of repetitions, matching only this process for exact start time, it’s more of an obvious clue.

  2. Procstat is more appropriate here as it tells us more about a specific process. Procstat indicates conclusively that this is a virtualmin/webmin issue.

Here’s the stat you asked for:

119 510993893 -rwxr-xr-x 1 root wheel 1021073040 5603960 "Apr  6 13:13:02 2023" "Mar 23 06:52:41 2023" "Mar 23 06:52:47 2023" "Mar 23 06:52:41 2023" 32768 11072 0 /usr/local/bin/php-cgi

Let me know if this offers you any insight I’ve missed.

  1. Procstat was run on one of these processes, it is in the top of this thread. I’ll re-paste it here to save you a scroll:
procstat -f 45223
  PID COMM                FD T V FLAGS    REF  OFFSET PRO NAME        
45223 php-cgi           text v r r-------   -       - -   /usr/local/bin/php-cgi
45223 php-cgi            cwd v d r-------   -       - -   /usr/local/lib/webmin/virtual-server
45223 php-cgi           root v d r-------   -       - -   /                 
45223 php-cgi           jail v d r-------   -       - -   /                 
45223 php-cgi              0 v c r-------   1       0 -   /dev/null         
45223 php-cgi              1 p - rw------   2       0 -   -                 
45223 php-cgi              2 p - rw------   2       0 -   -                 
[root@gaudete:/var/log/webmin]#
  1. on this box, running /usr/local/bin/php-cgi/php-cgi -v is very fast, and has no hang or consequence, even if done thousands of times by another script or process.

Good questions so far, let’s peel this back a little further.

What are the outputs of the following commands:

/usr/local/bin/php-cgi/php-cgi -v

and

stat /usr/local/bin/php-cgi/php-cgi

I’m not certain this contains useful information:

[root@gaudete:/var/log/php-fpm]# /usr/local/bin/php-cgi/php-cgi -v
-bash: /usr/local/bin/php-cgi/php-cgi: Not a directory
[root@gaudete:/var/log/php-fpm]# stat /usr/local/bin/php-cgi/php-cgi
stat: /usr/local/bin/php-cgi/php-cgi: stat: Not a directory

Did you perhaps mean “/usr/local/bin/php-cgi” :

[root@gaudete:/var/log/php-fpm]# /usr/local/bin/php-cgi -v

PHP 8.2.4 (cgi-fcgi) (built: Mar 23 2023 06:52:06)

Copyright (c) The PHP Group

Zend Engine v4.2.4, Copyright (c) Zend Technologies

with Zend OPcache v8.2.4, Copyright (c), by Zend Technologies

[root@gaudete:/var/log/php-fpm]# stat /usr/local/bin/php-cgi

119 510993893 -rwxr-xr-x 1 root wheel 1021073040 5603960 "Apr 6 15:22:35 2023" "Mar 23 06:52:41 2023" "Mar 23 06:52:47 2023" "Mar 23 06:52:41 2023" 32768 11072 0 /usr/local/bin/php-cgi

[root@gaudete:/var/log/php-fpm]#

I see another, related process hanging when it should go away. I suspect a conf issue inside FPM. Will reduce turnover times and tolerances to observe.

Any idea on where I can comment out the php-cgi -v for now and save a few kill lines?

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.