2

There seems to be an issue with cpu usage on my install of ubuntu. When using htop i get the following:

 1156 www-data  20   0  184872  20392   1440 R 12.6  2.0  11798:03 phpOBG8GM_jn7kb
 6295 www-data  20   0  184872  15028   2092 R 12.6  1.5 672:12.88 phptyWFNT_5llsm
18355 www-data  20   0  185004  17116     64 R 12.6  1.7  23720:57 phpFoPZUp_jhikt
19348 www-data  20   0  185004  16708   1608 R 12.6  1.6  23668:33 phppxfGf2_w3fce
28590 www-data  20   0  184872  19692    756 R 12.6  1.9   1178:06 phpf7InUV_4rgbs
 7956 www-data  20   0  184872  15072   2064 R 12.3  1.5   2329:51 php8MhPSj_txwza
15824 www-data  20   0  184872   7864   2572 R 12.3  0.8 291:12.02 phpAJBQo5_ippme
18023 www-data  20   0  185004  18940   1896 R 12.3  1.9  23738:00 phpF1VYi5_jqxf3
    1 root      20   0   37828   4844   2952 S  0.0  0.5   1:52.97 systemd

I have killed each process by pid, and then restarted Apache. The processes disappear, but then show up again? How can i kill them permanently?

1
  • Are you intending to run a web server? Commented Nov 14, 2017 at 20:57

2 Answers 2

0

Don't worry. These kinds of size and resource hogging issues due to session file traffic is a common affliction facing backup utilities, web servers, and other high uptime services. See, for instance... Ubuntu 16.04((HyperV)-very large file in /tmp,keeps growing... large CPU and network load while system is idle.

Note, that post is NOT a duplicate... your files are indeed Apache session files (per the /tmp/php*) ... but in that case you see that a backup utility (Duplicati) writing /tmp/dup* backup files wantonly will lead to much the same CPU hogging and gobbling storage seem similar. Naughty programs... abusing those temporary files.

Check out the [SOLVED] cross-post on ubuntuforums.org -- it happens but there's hope for them, and you as well.


Practically speaking, there's a simple solution, and a more in-depth multi-faceted one. Which will work for you will boil down to your usage plans.

Easy Fix (Bye, Bye, Bye [Web Server])

First question -- are you INTENDING to run an Apache Web server from your ailing box?

IF NOT, you arguable should disable Apache auto-startup by using update-rc.d to update the bootup services preferences in /etc/init.d/.

By default, many Linux distros will start Apache running -- even if you don't know what it does and never use it. Best case, maybe you can just flip the switch in the boot configuration and not only solve this issue, but guard yourself against some potential security risks in the process.


Stuck in the Web You're Spinning

But maybe you WANT to run a Web Server. Okay, okay.

In that case the fix isn't so ubiquitous and certain, but here's some suggestions of how to stabilize things and potentially find a fix...

From a paranoid I would recommend given these circumstances making sure you are up to date w/ the latest security patches. This is not meant to sound alarming... but of course there are Apache2 known exploits impacting your distro version's bundled copy of Apache... in fact there's even an article discussing exploiting your specific version for "educational purposes" (see CVEs: 1, 2, 3), so if you don't have these yet / recently installed, your behavior may be a sign of exploitation. Better safe than sorry.

A word of encouragement -- Ubuntu 16.04 has also been called "The Perfect Server" by some, so don't let vulnerabilities scare you off, just make sure out of an abundance of caution that your affairs are in order on the security front.

NEXT, confirm your suspicions (which I share) that these are indeed PHP session files from the Web Server, by verifying Apache's session files path... should match /tmp/ unless something very weird is going on.

Assuming a match, it's probably a configuration file issue, so buy yourself some time, as follows.

Destroy all sessions via a little PHP script and do a one-off cleanup to buy some time (see: How to clean /tmp? and How is the /tmp directory cleaned up?).

Now that the bleeding has slowed, reevaluate whether there's something odd that's causing Apache's zombie hunger. See:

From what I gathered, poorly curated configurations governing garbage collection / session lifetime are common causes for session files growing onerously large.

If none of that works, I would try to see whether the growth seems tied to certain circumstances and would definitely post details to the appropriate mailing list / ubuntuforums.org.

0

If you are using wordpress for your applications, you should consider to install a antimalware plugin and scan your WP applications. You can do htop command and then press L in the process to see where the files are coming from.

2
  • Your answer seems somewhat specific... I feel like something is missing. Can you clarify in it what leads you to suspect WordPress is the culprit behind Apache Web Server CPU usage/temporary file storage growth? Commented Nov 14, 2017 at 20:54
  • I had the same problem time ago, and I found out that some malwares were inside of my WP applications and those malwares used to generate those tmp files, that uses a lot of CPU. Maybe it does not occour only with WP, but it's a way to him to find out the problem. Commented Nov 16, 2017 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .