shoentjen

CloudLinux has told me:

Hello,

It appears that the issue should be fixed in the upcoming alt-php group release, where LiteSpeed SAPI will be updated to the version 7.0

The task ID is ALTPHP-464 (for your reference), we will mention it in our blog.

After it is available I will test it as soon as I can and post the results here.

I just mailed CloudLinux with access to a server. I referenced #27132.

@rodriguezzz You might want to try downgrading mod_lsapi, see if that changes anything for you.

> Sorry, It wasn’t my intention to confuse you.

Not to confuse me, but rather – giving information, that then later is “taken back” because you realize your “apparent” fix, isn’t actually a fix – makes things confusing for multiple parties.

I might have been a bit too quick to post here again, yes. At least I am trying to be helpful.

> To add to that, when you mentioned which ea-php70 packages you have, you listed php-litespeed

Yes, of a single out of 30 boxes. Also just because you have the package installed, doesn’t mean all domains use lsapi, it’s quite easy to disable for a domain by setting another handler, or if you’re using php-fpm for certain sites.

Well, you didn’t say so and I had no way to guess. I still think my question if everybody experiencing the issue was using mod_lsapi was a very legitimate one that was helpful in determining the cause of the issue. But as I understand now, you are certain the affected users you see don’t use mod_lsapi. Do you care to mention what they do use?

> seems fixed after I downgraded PHP 7.x and mod_lsapi

It would be good to mention specific versions of your packages, there’s I believe 24x PHP 7.0.x releases, 10x 7.1.x releases.

We were experiencing the issue with:
alt-php70-7.0.23-2.el6.x86_64
alt-php71-7.1.9-2.el6.x86_64
httpd24-mod_lsapi-1.1-18.el6.cloudlinux.x86_64

After downgrading to the following, the issue was gone again:
alt-php70-7.0.21-1.el6.x86_64
alt-php71-7.1.7-1.el6.x86_64
httpd24-mod_lsapi-1.1-9.el6.cloudlinux.x86_64

For example we experienced the issue back in July as well and at that time we were using PHP 7.0.21 and lsapi 1.0-30

Now this would have been helpful to mention before. If you are sure it is the same issue: what at the time fixed it for you?

@lucasrolff Sorry, It wasn’t my intention to confuse you.

That it happens on servers with and without mod_lsapi is new information. Nobody here mentioned how their PHP was loaded, and since we only use mod_lsapi ourselves *and* the issue appeared for us after we did an update containing both a newer mod_lsapi and new PHP7.x versions I thought it was a good thing to ask. To add to that, when you mentioned which ea-php70 packages you have, you listed php-litespeed. AFAIK this package is only useful if you use litespeed as a webserver or apache with mod_lsapi.

Anyyway, for me the issue seems fixed after I downgraded PHP 7.x and mod_lsapi, and restarted our webservers. I mean, .cagefs/tmp/php?????? file are still created, but their size is < 1MB where previously I saw files with a size of tens or hundreds of GB’s.

PHP downgrade didn’t seem to help after all. I now downgraded mod_lsapi and this seems to work. Will know for sure on moday I guess.

Do all you guys use mod_lsapi as well?

Files were a bit bigger than I initially thought:

ll -htr /home/$USER/.cagefs/tmp/php??????
-rw------- 1 $USER $USER 344G Sep 14 10:44 /home/$USER/.cagefs/tmp/php7gIUGQ
-rw------- 1 $USER $USER 353G Sep 14 16:09 /home/$USER/.cagefs/tmp/phpp4YmGT
-rw------- 1 $USER $USER 352G Sep 14 21:24 /home/$USER/.cagefs/tmp/phpvjfIOe
-rw------- 1 $USER $USER 345G Sep 15 02:28 /home/$USER/.cagefs/tmp/phpNOd0nH
-rw------- 1 $USER $USER 365G Sep 15 07:32 /home/$USER/.cagefs/tmp/phpNaCuXj
-rw------- 1 $USER $USER 344G Sep 15 12:31 /home/$USER/.cagefs/tmp/php7TM8yO

I just downgraded alt-php70 to 7.0.21-1.el6.x86_64 and alt-php71 to 7.1.7-1.el6.x86_64 and so far the issue seems gone.

I have notified CloudLinux of this issue and suggested they chime in here.
Also, we don’t have cPanel, so you can exclude that from the possible causes.
Aside from that we use CloudLinux Server release 6.9, not 7.4.
I guess the issue is more in the PHP version used (and in Wordfence) than in the CloudLinux OS.

• This reply was modified 7 years, 2 months ago by shoentjen.

I also see this issue. Filesize differs, but up to 35GB is not uncommon.
we use the alt-php* packages provided by CloudLinux.