Top command not showing filenames in the command option (using mod_fcgid)

[iNF3RN0]

Hi,

I recently switched to mod_fcgid using the easyapache from WHM. Everything is working fine however one user account is causing high cpu load, when I typed the "top -c" command I got the following output:

top - 12:44:59 up 18 days,  1:23,  2 users,  load average: 1.02, 0.95, 0.97
Tasks: 240 total,   1 running, 238 sleeping,   0 stopped,   1 zombie
Cpu(s):  5.8%us,  1.0%sy,  0.0%ni, 92.9%id,  0.1%wa,  0.1%hi,  0.2%si,  0.0%st
Mem:   8166356k total,  6058564k used,  2107792k free,   726696k buffers
Swap: 16777208k total,       12k used, 16777196k free,  3758036k cached

PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                   
 5072 mysql     10  -5 1101m 615m 4768 S 19.3  7.7   2527:41 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-fi
 8326 eonline  15   0  512m  70m  50m S 12.3  0.9   0:47.90 /usr/bin/php                                                               
 9659 eonline  16   0  511m  56m  34m S 12.3  0.7   0:05.97 /usr/bin/php                                                               
 8448 garena  16   0  513m  52m  29m S  3.3  0.7   0:11.96 /usr/bin/php                                                               
 7193 classifi  16   0  518m  62m  34m S  1.0  0.8   0:30.29 /usr/bin/php                                                               
 8931 nobody    15   0 72356 4788 1928 S  0.3  0.1   0:00.27 /usr/local/apache/bin/httpd -k start -DSSL                                 
 9410 nobody    15   0 72352 4788 1928 S  0.3  0.1   0:00.09 /usr/local/apache/bin/httpd -k start -DSSL

as you can see it's only showing "/usr/bin/php" in the command but not the filename/name of the script which is causing the load..how do I get the filename so I can warn the user that he should control or remove his script?

I tried WHM "daily process log" option as well and it's showing the same thing i-e no file name in the command column. Are filenames only available with suPHP? is there any work around available for mod_fcgid for tracking down the bad script?

Thanks,

[twhiting9275]

The best answer to this would be to use lsof, as:

lsof -p (pid) | grep (user) | grep /home/ | more

This should help you figure out what is what.
so for

 7193 classifi  16   0  518m  62m  34m S  1.0  0.8   0:30.29 /usr/bin/php

You would want to try

lsof  -p 7193 | grep classifi | grep /home/

[iNF3RN0]

@twhiting9275: thanks for your reply mate, I typed the following on shell:

lsof  -p 9540 | grep classifi | grep /home/

and I got the following output:

php     9540 classifi  cwd    DIR      253,4     4096  61112322 /home/classifi/public_html

so I got the directory but I want to know which script i-e the filename causing the issue, secondly can you please explain me what is mean by these numbers: 253,4 4096 61112322

[twhiting9275]

most likely the process ID has changed here. try doing this:

ps xua | grep classifi

that might give you a little bit more help?

In addition, if php itself is called, without the script, for some reason, you're going going to have some tough times finding that specific script

[iNF3RN0]

yes the process ID has changed however when I was on SuPHP it used to display the file name for example: /usr/bin/php vbseo.php etc but after switching to mod_fcgid it's not working :S it's getting difficult for me to track each user who are using some buggy PHP scripts which are take large chunk of CPU usage.

And the command "ps xua | grep classifi" is of no help either, I am still getting /usr/bin/php but not the actual filename or path to the scrip which is running and taking the CPU.

Anyway thanks for your help mate

[madaboutlinux]

Yes, it is a bit of problem when PHP is called without a script which is when only the directory will be displayed. However, have you tried WHM >> 'Apache Status' section. It does list the exact filename that is been called.

[iNF3RN0]

Yes, it is a bit of problem when PHP is called without a script which is when only the directory will be displayed. However, have you tried WHM >> 'Apache Status' section. It does list the exact filename that is been called.

Thanks for your reply, yes it does but if I am not wrong it only shows the httpd requests load and information right? it to list some MOD_FCGID info as well but not in details i-e with filename. Looks like I need to switch back to SuPHP :S