PHP LSAPI ProcessGroup Mode

What is suEXEC?

suEXEC is an execution method that makes PHP more secure by running each PHP process as the owner of a particular account instead of the user running the web server. This means that even if one user on a server is compromised, PHP scripts run from their account will not have access to other users' files. suEXEC has long been a basic feature of shared hosting and is completely supported by all LiteSpeed PHP process modes.

Benefits

Faster process generation

ProcessGroup mode enjoys reduced overhead and faster process generation by forking child processes instead of creating new processes for each new request from the same user.

LiteSpeed's most powerful opcode caching

Like Daemon mode, ProcessGroup mode makes use of opcode caching with the added benefit of having per-user opcode caches when running PHP using a suEXEC execution method.

Custom php.ini files

Because each process group has its own parent process, ProcessGroup mode is compatible with custom php.ini files and CloudLinux’s PHP Selector.

Can be set at the server or vhost level

You can enable ProcessGroup mode at either the server or virtual host level through an httpd.conf file directive. By placing this directive in a virtual host level configuration file, you can decide which users get a personal opcode cache.

Comparison to Other Setups

• Apache/nGinx (suPHP) vs. LSPHP

  suPHP is the standard suEXEC setup for Apache.

  • All LSWS process modes (Worker, Daemon, and ProcessGroup) are far faster than suPHP because suPHP uses CGI which is much, much slower than LiteSpeed's LSAPI.
  • suPHP creates a new standalone process for each PHP process. As explained above, creating these new processes requires overhead, is time-consuming, and prevents the effective use of opcode cache.

• Apache/nGinx (PHP-FPM) vs. ProcessGroup mode

  PHP-FPM allows Apache and other web servers to make use of FastCGI with PHP.

  • FastCGI is a speedier than CGI, but, our benchmarks show, LSAPI is still about 20% faster than FCGI.
  • Compared to PHP-FPM + suEXEC where each user must have a process pool manually set up for them, ProcessGroup mode can more easily and quickly achieve the same level of security. Simply add the ProcessGroup directive in the server level httpd.conf file while using a suEXEC execution method.
  • When running PHP using a suEXEC execution method, ProcessGroup mode will conserve resources by killing parent processes that have been idle too long. This is more efficient than Apache + PHP-FPM where at least one process is always running in each user's pool.

• Daemon mode vs. ProcessGroup mode

  LiteSpeed's Daemon mode forks all processes from one constantly running daemon process.

  • Because Daemon mode forks all processes off a single parent process, every user on that server will share a single large opcode cache. If there are many users, this opcode cache can fill quickly, pushing other user’s scripts out of the cache. By providing per-user opcode caches, each user's scripts remain in their opcode cache irrespective of what other users are doing.
  • Unlike Daemon mode, ProcessGroup mode is compatible with custom php.ini files and CloudLinux’s PHP Selector.
  • ProcessGroup mode can require more resources than Daemon mode as each process group must have its own parent process in addition to other processes. Giving each user a per-user opcode cache should mean more memory for opcode caching than having everyone share one opcode cache.
  • You can use ProcessGroup mode in conjunction with Daemon mode by setting up Daemon mode at the server level and enabling ProcessGroup mode on certain virtual hosts that require more powerful opcode caching.

See our comparison of Process modes for more information

Limitations

ProcessGroup mode keeps one parent process running in addition to all of it's child processes. This creates a lot of extra processes that you would not have in LiteSpeed’s Worker or Daemon modes. You can control this to some degree with the Max Idle Time setting. This setting informs LiteSpeed Web Server to kill ProcessGroup parent processes that are idle for longer than the time set.

Personal opcode caches must be reasonably large to be of any real use which almost certainly means setting aside more RAM for opcode caching than you would in Daemon mode. This limits ProcessGroup mode to hosts who are willing to use extra memory to see performance enhancements. Be careful not to portion out too much memory for per-user opcode caches as you could run out of memory.

Configuration

Learn more about configuring ProcessGroup mode in our wiki.