Big phpXXXXXX files in /home/USER/.cagefs/tmp

[rarod]

Hi all.

I have some users with huge tmp files (between 500MB and 2GB): /home/$USER/.cagefs/tmp/phpXXXXXX

I have other servers with the same issue. I do not know if this is the root of the issue but users bith bigger "phpXXXXXX" files are using Wordpress+plugins with php7.

Any Ideas?

Sistem info:

[[email protected] ~]# cat /etc/redhat-release
CloudLinux release 7.4 (Georgy Grechko)

CPanel 11.66.0.17

[[email protected] ~]# ls -larth /home/$USER/.cagefs/tmp/php*
-rw------- 1 $USER $USER 700M ago 24 10:47 /home/$USER/.cagefs/tmp/php3bLX6P
-rw------- 1 $USER $USER 752M ago 24 10:48 /home/$USER/.cagefs/tmp/phpyQVlXK
-rw------- 1 $USER $USER 1,2G ago 29 05:00 /home/$USER/.cagefs/tmp/phpTVL8ud
-rw------- 1 $USER $USER 1,2G ago 29 19:04 /home/$USER/.cagefs/tmp/phpEWRNjt
-rw------- 1 $USER $USER 1,2G ago 29 21:16 /home/$USER/.cagefs/tmp/php5IRtuJ
-rw------- 1 $USER $USER 1,1G ago 30 05:47 /home/$USER/.cagefs/tmp/phppCg2ag
-rw------- 1 $USER $USER 1,2G ago 30 15:31 /home/$USER/.cagefs/tmp/phpFvflBt
-rw------- 1 $USER $USER 1,2G ago 30 18:55 /home/$USER/.cagefs/tmp/phpl438Jl
-rw------- 1 $USER $USER 1,2G sep  1 04:40 /home/$USER/.cagefs/tmp/phpnvjn9N
-rw------- 1 $USER $USER 1,2G sep  1 05:06 /home/$USER/.cagefs/tmp/php5afzuV
-rw------- 1 $USER $USER 1,2G sep  1 11:52 /home/$USER/.cagefs/tmp/phpO427u7
-rw------- 1 $USER $USER 1,2G sep  1 14:39 /home/$USER/.cagefs/tmp/phpbRucIl
-rw------- 1 $USER $USER 1,2G sep  3 05:57 /home/$USER/.cagefs/tmp/phpie8a2k
-rw------- 1 $USER $USER 656M sep  3 16:23 /home/$USER/.cagefs/tmp/phpHNSknY
-rw------- 1 $USER $USER 818M sep  3 16:24 /home/$USER/.cagefs/tmp/php5H7kSj
-rw------- 1 $USER $USER 1,2G sep  3 17:41 /home/$USER/.cagefs/tmp/phpJiCASm

[[email protected] ~]# file /home/$USER/.cagefs/tmp/phpJiCASm
/home/$USER/.cagefs/tmp/phpJiCASm: data

[[email protected] ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | head -n 20
is_editor_page/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b763f
tve_tcb__license_activated/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b773a
is_editor_page_raw/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b7988
tve_enqueue_editor_scripts/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9131
tve_enqueue_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b953f
tve_get_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9758
tve_get_style_family_class/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9900
OxK.
tve_change_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9af2
tve_load_custom_css/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba10e
tve_check_in_loop/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba2c1
tve_restore_script_tags_replace/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba400
tve_restore_script_tags/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba7ed
tve_get_thrive_optins/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba96e
tve_leads_additional_fields_filters/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bad75
tve_thrive_shortcodes/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bb9db
]ePK
tve_do_post_grid_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbb7b
tve_do_optin_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbd27
tve_do_posts_list_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbe5e

[[email protected] ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | tail -n 20
LIKE
LEFT
LEAVE
LEADING
KILL
KEYS
rules
scanner
subject
T_COMMA
T_COMMA
T_DOT
T_DOT
filters
/\]/
/\[/
getWAF
setWAF
/\)/
/\(/

 

[Eminds]

most probably these are cache files generated by the wordpress cache plugins , once the cache is cleared the files should be removed.

 

[24x7server]

Hi,

Check the below link, which refer to the same issue you are facing..
User's .cagefs/tmp/ directory filling with thousands of session files

 

[rarod]

I correlated some dates from a strace and pointed to this lines in apache error_log:

[Tue Sep 05 13:54:34.492388 2017] [lsapi:error] [pid 24925] [client ip-edited:54084] [host www.domain-edited.com] get_client_block(16384) failed, referer: https://www.domain-edited.com/XXXXXXXXXXXXXXXXXXXXXXXXXX/
[Tue Sep 05 13:54:34.492417 2017] [lsapi:error] [pid 24925] [client ip-edited:54084] [host www.domain-edited.com] Client error on sending request(POST /wp-admin/admin-ajax.php HTTP/1.1); uri(/wp-admin/admin-ajax.php) content-length(735): user_get_body(tmpstackbuf, 16384): read from client failed, referer: https://www.domain-edited.com/XXXXXXXXXXXXXXXXXXXXXXXXXX/

Any ideas?

Hi,

Check the below link, which refer to the same issue you are facing..
User's .cagefs/tmp/ directory filling with thousands of session files

Not the same issue, but thanks anyway.

most probably these are cache files generated by the wordpress cache plugins , once the cache is cleared the files should be removed.

I already think in cache problems, but at the time I got nothing clear. Thanks.

 

[cPanelMichael]

Hello,

CloudLinux documents the CageFS tmp directory, including steps to manually clean up temporary files, at:

CloudLinux Documentation

Could you let us know if that helps to clear these files?

Thank you.

 

[rarod]

I traced the issue down to the wordfence plugin. But I do not know why it is creating such big tmp files. With high php max_execution_time and high lsapi lsapi_backend_max_process_time this tmp files appears to grow infinitely.

 

[cPanelMichael]

You may also want to reach out to CloudLinux directly for their feedback on this topic since the issue relates to CageFS:

CloudLinux - Contact Support

Thank you.