Big phpXXXXXX files in /home/USER/.cagefs/tmp

rarod

Active Member
Apr 20, 2017
36
2
8
Spain
cPanel Access Level
Root Administrator
Hi all.

I have some users with huge tmp files (between 500MB and 2GB): /home/$USER/.cagefs/tmp/phpXXXXXX

I have other servers with the same issue. I do not know if this is the root of the issue but users bith bigger "phpXXXXXX" files are using Wordpress+plugins with php7.

Any Ideas?

Sistem info:
Code:
[[email protected] ~]# cat /etc/redhat-release
CloudLinux release 7.4 (Georgy Grechko)

CPanel 11.66.0.17
Code:
[[email protected] ~]# ls -larth /home/$USER/.cagefs/tmp/php*
-rw------- 1 $USER $USER 700M ago 24 10:47 /home/$USER/.cagefs/tmp/php3bLX6P
-rw------- 1 $USER $USER 752M ago 24 10:48 /home/$USER/.cagefs/tmp/phpyQVlXK
-rw------- 1 $USER $USER 1,2G ago 29 05:00 /home/$USER/.cagefs/tmp/phpTVL8ud
-rw------- 1 $USER $USER 1,2G ago 29 19:04 /home/$USER/.cagefs/tmp/phpEWRNjt
-rw------- 1 $USER $USER 1,2G ago 29 21:16 /home/$USER/.cagefs/tmp/php5IRtuJ
-rw------- 1 $USER $USER 1,1G ago 30 05:47 /home/$USER/.cagefs/tmp/phppCg2ag
-rw------- 1 $USER $USER 1,2G ago 30 15:31 /home/$USER/.cagefs/tmp/phpFvflBt
-rw------- 1 $USER $USER 1,2G ago 30 18:55 /home/$USER/.cagefs/tmp/phpl438Jl
-rw------- 1 $USER $USER 1,2G sep  1 04:40 /home/$USER/.cagefs/tmp/phpnvjn9N
-rw------- 1 $USER $USER 1,2G sep  1 05:06 /home/$USER/.cagefs/tmp/php5afzuV
-rw------- 1 $USER $USER 1,2G sep  1 11:52 /home/$USER/.cagefs/tmp/phpO427u7
-rw------- 1 $USER $USER 1,2G sep  1 14:39 /home/$USER/.cagefs/tmp/phpbRucIl
-rw------- 1 $USER $USER 1,2G sep  3 05:57 /home/$USER/.cagefs/tmp/phpie8a2k
-rw------- 1 $USER $USER 656M sep  3 16:23 /home/$USER/.cagefs/tmp/phpHNSknY
-rw------- 1 $USER $USER 818M sep  3 16:24 /home/$USER/.cagefs/tmp/php5H7kSj
-rw------- 1 $USER $USER 1,2G sep  3 17:41 /home/$USER/.cagefs/tmp/phpJiCASm
[[email protected] ~]# file /home/$USER/.cagefs/tmp/phpJiCASm
/home/$USER/.cagefs/tmp/phpJiCASm: data

Code:
[[email protected] ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | head -n 20
is_editor_page/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b763f
tve_tcb__license_activated/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b773a
is_editor_page_raw/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b7988
tve_enqueue_editor_scripts/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9131
tve_enqueue_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b953f
tve_get_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9758
tve_get_style_family_class/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9900
OxK.
tve_change_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9af2
tve_load_custom_css/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba10e
tve_check_in_loop/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba2c1
tve_restore_script_tags_replace/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba400
tve_restore_script_tags/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba7ed
tve_get_thrive_optins/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba96e
tve_leads_additional_fields_filters/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bad75
tve_thrive_shortcodes/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bb9db
]ePK
tve_do_post_grid_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbb7b
tve_do_optin_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbd27
tve_do_posts_list_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbe5e
Code:
[[email protected] ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | tail -n 20
LIKE
LEFT
LEAVE
LEADING
KILL
KEYS
rules
scanner
subject
T_COMMA
T_COMMA
T_DOT
T_DOT
filters
/\]/
/\[/
getWAF
setWAF
/\)/
/\(/
 
Last edited by a moderator:

rarod

Active Member
Apr 20, 2017
36
2
8
Spain
cPanel Access Level
Root Administrator
I correlated some dates from a strace and pointed to this lines in apache error_log:

[Tue Sep 05 13:54:34.492388 2017] [lsapi:error] [pid 24925] [client ip-edited:54084] [host www.domain-edited.com] get_client_block(16384) failed, referer: https://www.domain-edited.com/XXXXXXXXXXXXXXXXXXXXXXXXXX/
[Tue Sep 05 13:54:34.492417 2017] [lsapi:error] [pid 24925] [client ip-edited:54084] [host www.domain-edited.com] Client error on sending request(POST /wp-admin/admin-ajax.php HTTP/1.1); uri(/wp-admin/admin-ajax.php) content-length(735): user_get_body(tmpstackbuf, 16384): read from client failed, referer: https://www.domain-edited.com/XXXXXXXXXXXXXXXXXXXXXXXXXX/
Any ideas?




Hi,

Check the below link, which refer to the same issue you are facing..
User's .cagefs/tmp/ directory filling with thousands of session files
Not the same issue, but thanks anyway.

most probably these are cache files generated by the wordpress cache plugins , once the cache is cleared the files should be removed.
I already think in cache problems, but at the time I got nothing clear. Thanks.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Hello,

CloudLinux documents the CageFS tmp directory, including steps to manually clean up temporary files, at:

CloudLinux Documentation

Could you let us know if that helps to clear these files?

Thank you.
 

rarod

Active Member
Apr 20, 2017
36
2
8
Spain
cPanel Access Level
Root Administrator
I traced the issue down to the wordfence plugin. But I do not know why it is creating such big tmp files. With high php max_execution_time and high lsapi lsapi_backend_max_process_time this tmp files appears to grow infinitely.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
You may also want to reach out to CloudLinux directly for their feedback on this topic since the issue relates to CageFS:

CloudLinux - Contact Support

Thank you.