SOLVED sites still accessing ea-php56

[audrey]

Hi

All sites on all servers have been switched to PHP 7.3
but-
CSF firewall is still sending me emails saying
Excessive processes running under a user are still opening ea-php56 files

for example- processes are accessing
exe:/opt/cpanel/ea-php56/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php56/root/usr/bin/php-cgi

I am not worried about CSF telling me excessive processes - I know how to deal with that.

I am trying to figure out how sites that are set in the WHM to use PHP 7.3 are still accessing PHP 5.6.
I am assuming - in some cases - old wordpress themes and plugins are the issue- but - that is just my guess.
Any other ideas on how this is happening?

How do I search in SSH to find out exactly what scripts are still accessing older versions of PHP?
(I want to see for all sites - not just one user)

Thanks for your help
Audrey

 

[quietFinn]

This forum post might help:

SOLVED - How to find which domains using a specific PHP version?

Hi, Assumes my server has hundreds of domains. I want to have a quick way to show domains that are using PHP version 7 for some debugging work. (Currently most domains on the server are using php 5.6, it is very difficult to manually find domains that are using a specific PHP version). Thank you!

forums.cpanel.net

 

[audrey]

Thanks but that post does not help.
I know how to see what sites are set for what version of php

I want to know what scripts are actually accessing PHP 5.6 even thought the sites are set to PHP 7.3

 

[cPanelLauren]

Hi @audrey

A few questions:

1. What version of cPanel/WHM are you running?

2. When you go to WHM>>Software>>MultiPHP Manager what is set for System PHP version?

3. In MultiPHP Manager through WHM are there any domains using PHP 5.6?

 

[audrey]

Hi Lauren

Thanks for your help

answers inline below

1. What version of cPanel/WHM are you running?

v80.0.24


2. When you go to WHM>>Software>>MultiPHP Manager what is set for System PHP version?

PHP 7.1


3. In MultiPHP Manager through WHM are there any domains using PHP 5.6?

Two domains are using PHP 5.6 - they are working on updating their scripts
but the site that CSF claims is using excessive PHP 5.6 resources is set to PHP 7.3 in the WHM

Thanks again
Take Care
Audrey

 

[cPanelLauren]

Great, thank you. For the account that CSF is flagging, is it a specific domain that its flagging or the cPanel account?

If it's an account are there addon domains or subdomains?

If there are additional domains on the account and CSF is flagging for the account not a specific domain are any of the domains using php 5.6 associated with that account?

 

[audrey]

Thanks again for your help

It is flagging the username
User:USERNAME PID:29344 PPID:28134 Run Time:31(secs) Memory:244108(kb) RSS:48516(kb) exe:/opt/cpanel/ea-php56/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php56/root/usr/bin/php-cgi

no addon domains or subdomains

I do not get the CSF message continually - I upgraded wordpress plugins and themes on this site- no complaints from CSF again - so far on this site.

I do get CSF complaints from another site that uses PHP 7.1. The complaints from CSF do reference PHP 7.1 and that is what the site is set for in WHM

I want to uninstall PHP 5.6 from this server and other servers - but - I do not want to uninstall it if sites are still accessing it. That is why I am trying to figure out how to tell if sites are still accessing PHP 5.6. If I can figure out which sites are still accessing PHP 5.6 - then I can address each site's access before I remove PHP 5.6 from the servers

 

[cPanelLauren]

You might be able to check using the PID, in the event it's still running.

You might also double check there isn't anything strange happening with the site associated with that account and add a phpinfo page to ensure it's running php 7.1. Pending the site does come back as running php 7.1 if there are no additional sites nothing should be running any other version of php in affiliation with that account.

 

[audrey]

Thanks again for your help

phpinfo said 5.6
I reset in the WHM to 7.0 and then 7.1 and now phpinfo is correct

Problem solved

Take Care
Audrey