PHP-FPM is running high server load but also WHM tells me that PHP-FPM is disabled, what's going on?

[martin MHC]

WHM version:
102.0.28

Server:
CentOS 7.9


Goooood morning.


We do not use PHP-FPM on the server, with our PHP systems being run via suphp (for better or worse).

This has been standard forever, we have NEVER turned on PHP-FPM. But today, for the first time I'm noticing two distinct things:

1) A specfic account is stating as having PHP FPM pool users on the process manager.

2) This same specific account is has some PHP scripts running with huge CPU usage; almost 20.00 usage from a single script.

Please see the screenshots below to show the status of PHP FPM .

My question is :

I have read Cpanel FPM documentation and this doesn't seem to make me any wiser (because, I have no experience of FPM) . I have also read similar posts but they're not clarifying what can be going on here (maybe unrelated)


What can be the possible causes of this activity?

I do not believe it to be incidental things such as Backup creation or webmail, as I say, these are both brand new activities we've not seen on the server before and curious where they came from and if we can mitigate them or revert them.




AND




Thank you.

 

[cPRex]

Hey there! Just to confirm, can you run the following command on the system and post the output?

ps aux | grep fpm

 

[martin MHC]

Hey there! Just to confirm, can you run the following command on the system and post the output?

ps aux | grep fpm

hi Rex,
The output from this is:

root      2518  0.0  0.0 255164  1332 ?        Ss   Feb11   0:42 php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf)
root     29557  0.0  0.0 112812   976 pts/0    S+   19:17   0:00 grep --color=auto fpm

 

[cPRex]

Thanks for that output. Did you also see the high CPU usage in WHM during the time you ran that command? This only shows the main process running and not any user processes.

 

[martin MHC]

Thanks for that output. Did you also see the high CPU usage in WHM during the time you ran that command? This only shows the main process running and not any user processes.

Hi Rex, no, I didn't notice any high CPU usage then, the high CPU usage is intermittent but checking the Process Manager it seems to be when PHP scripts in the account are run .

Checking the Process Manager now, there are no PHP-FPM processes running (aside from " php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf) " ), no high server load and everything seems fine.

I was curious of there was any sort of incidental program / script that uses PHP FPM in WHM / cPanel as I haven't seen this before and the high server load concerned me. Cheers.

 

[cPRex]

In WHM >> Service Manager, do you have the "PHP-FPM service for cPanel Daemons" option turned on? That would allow PHP-FPM to be used for internal cPanel processes.

 

[martin MHC]

In WHM >> Service Manager, do you have the "PHP-FPM service for cPanel Daemons" option turned on? That would allow PHP-FPM to be used for internal cPanel processes.

Hello @cPRex yes, this service is turned on. If this process is the cause how come the Process Manager shows PHP FPM pool_users which is a process I don't think I've seen on the PM screen before ?


Cheers

 

[cPRex]

I suppose it's possible.

Ideally, you want to run that "ps aux" command when you notice one of the high CPU processes on the system, to see if you can correlate that to anything specific.

 

[martin MHC]

Ideally, you want to run that "ps aux" command when you notice one of the high CPU processes on the system, to see if you can correlate that to anything specific.

That's worth knowing. Thanks!

 

[kdean]

Usually seeing a pool user_ process running is a good indicator that someone has webmail open for an email belonging to that user account.

Maybe they were doing something to cause a long lasting process to occur that's using cpu, like searching a large mailbox without SOLR installed or moving or filtering a large amounf of mail in a large mailbox, Off hand i don't recall how the CPU usage split is between an IMAP process and the web process. I would presume that it would have to be something processing on the web side for it to eat up cpu like that.

If you run the command:

doveadm who

… you can see which emails are currently connecting at the time to narrow things down.

At least that's my guess. Although perhaps if someone was using File Manager in cPanel for a file transfer it could maybe use some resources. My clients don't really use File Manager so I haven't observed it's impact.

 

[kdean]

! further note that could generate higher cpu usage, is if someone was logged into cPanel for that account and manually triggered an account backup that was zipping everything up at the time. Just another thought.