[suPHP] suPHP Zombies

[Jeremy Chadwick]

On Tue, May 06, 2008 at 08:59:14AM -0400, Dan Mahoney, System Admin wrote:
> On Tue, 6 May 2008, Jeremy Chadwick wrote:
>
>> The parent process in your case is httpd, which means that Apache (or a
>> related Apache module) is not calling wait() when waiting for a child to
>> finish.
>>
>> So, there is a possibility suPHP is responsible for this.  The way it
>> works, without going into suphp.conf semantics:
>>
>>  1) httpd loads mod_suphp.so
>>  2) mod_suphp.so executes /usr/local/bin/suphp
>>  3) /usr/local/bin/suphp executes /usr/local/bin/php-cgi
>>  4) /usr/local/bin/php-cgi parses PHP script and outputs data to
>>  stdout, which makes it back to httpd.
>>
>> Here's the problem: there's not going an easy way to trace this down,
>> because Apache makes debugging children it forks off fairly difficult.
>> The problem could be in any of 3 places.
>
> Why not?
>
> Three (kinda) words for you.  mod_log_forensic.  Available in every apache 
> since 1.3.30
>
> Basically, writes to a logfile whenever a process request *starts* and when 
> it *ends*.  Comes with a script to grep the log for lines that don't have 
> an end.  Includes the request url.
>
> http://httpd.apache.org/docs/1.3/mod/mod_log_forensic.html
>
> See if this helps you.  It may not, as somehow apache may write the logfile 
> line and assume the suPHP child successfully returned (but I don't *think* 
> so, because apache includes things in logs like how many seconds it took to 
> serve a request).

I can see how this is useful, but it isn't going to tell you which of
the above 3 pieces isn't calling wait().  The only way one is going to
find that out is via truss or strace on each child.

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |