Big phpXXXXXX files in /home/USER/.cagefs/tmp

Hi all.

I have some users with huge tmp files (between 500MB and 2GB): /home/$USER/.cagefs/tmp/phpXXXXXX

I have other servers with the same issue. I do not know if this is the root of the issue but users bith bigger "phpXXXXXX" files are using Wordpress+plugins with php7.

Any Ideas?

Sistem info:

Code:

[root@server ~]# cat /etc/redhat-release
CloudLinux release 7.4 (Georgy Grechko)

CPanel 11.66.0.17

Code:

[root@server ~]# ls -larth /home/$USER/.cagefs/tmp/php*
-rw------- 1 $USER $USER 700M ago 24 10:47 /home/$USER/.cagefs/tmp/php3bLX6P
-rw------- 1 $USER $USER 752M ago 24 10:48 /home/$USER/.cagefs/tmp/phpyQVlXK
-rw------- 1 $USER $USER 1,2G ago 29 05:00 /home/$USER/.cagefs/tmp/phpTVL8ud
-rw------- 1 $USER $USER 1,2G ago 29 19:04 /home/$USER/.cagefs/tmp/phpEWRNjt
-rw------- 1 $USER $USER 1,2G ago 29 21:16 /home/$USER/.cagefs/tmp/php5IRtuJ
-rw------- 1 $USER $USER 1,1G ago 30 05:47 /home/$USER/.cagefs/tmp/phppCg2ag
-rw------- 1 $USER $USER 1,2G ago 30 15:31 /home/$USER/.cagefs/tmp/phpFvflBt
-rw------- 1 $USER $USER 1,2G ago 30 18:55 /home/$USER/.cagefs/tmp/phpl438Jl
-rw------- 1 $USER $USER 1,2G sep  1 04:40 /home/$USER/.cagefs/tmp/phpnvjn9N
-rw------- 1 $USER $USER 1,2G sep  1 05:06 /home/$USER/.cagefs/tmp/php5afzuV
-rw------- 1 $USER $USER 1,2G sep  1 11:52 /home/$USER/.cagefs/tmp/phpO427u7
-rw------- 1 $USER $USER 1,2G sep  1 14:39 /home/$USER/.cagefs/tmp/phpbRucIl
-rw------- 1 $USER $USER 1,2G sep  3 05:57 /home/$USER/.cagefs/tmp/phpie8a2k
-rw------- 1 $USER $USER 656M sep  3 16:23 /home/$USER/.cagefs/tmp/phpHNSknY
-rw------- 1 $USER $USER 818M sep  3 16:24 /home/$USER/.cagefs/tmp/php5H7kSj
-rw------- 1 $USER $USER 1,2G sep  3 17:41 /home/$USER/.cagefs/tmp/phpJiCASm

[root@server ~]# file /home/$USER/.cagefs/tmp/phpJiCASm
/home/$USER/.cagefs/tmp/phpJiCASm: data

Code:

[root@server ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | head -n 20
is_editor_page/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b763f
tve_tcb__license_activated/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b773a
is_editor_page_raw/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b7988
tve_enqueue_editor_scripts/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9131
tve_enqueue_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b953f
tve_get_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9758
tve_get_style_family_class/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9900
OxK.
tve_change_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9af2
tve_load_custom_css/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba10e
tve_check_in_loop/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba2c1
tve_restore_script_tags_replace/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba400
tve_restore_script_tags/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba7ed
tve_get_thrive_optins/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba96e
tve_leads_additional_fields_filters/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bad75
tve_thrive_shortcodes/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bb9db
]ePK
tve_do_post_grid_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbb7b
tve_do_optin_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbd27
tve_do_posts_list_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbe5e

Code:

[root@server ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | tail -n 20
LIKE
LEFT
LEAVE
LEADING
KILL
KEYS
rules
scanner
subject
T_COMMA
T_COMMA
T_DOT
T_DOT
filters
/\]/
/\[/
getWAF
setWAF
/\)/
/\(/

 

I correlated some dates from a strace and pointed to this lines in apache error_log:

Any ideas?

Not the same issue, but thanks anyway.

I already think in cache problems, but at the time I got nothing clear. Thanks.

 

I traced the issue down to the wordfence plugin. But I do not know why it is creating such big tmp files. With high php max_execution_time and high lsapi lsapi_backend_max_process_time this tmp files appears to grow infinitely.