What is this? to_avoid_overwrite_important_env

[Peps]

Hi,

I'm seeing this pass by in the process manager:
"lsphp:XXXXXXXX.eu/private_html/wp-admin/admin-ajax.phto_avoid_overwrite_important_env"

Also had one such process hanging which needed to be killed manually.

Can't find anything about this on Google. Any ideas?
Thanks!

 

[NiteWave]

looks like bug somewhere.

what's the lsws version and lsphp version ? os ?

 

[Peps]

LiteSpeed Web Server Enterprise 6.0.11
For this user lsphp 7.4 (but also 8.0 and 8.1 is installed)
OS = CentOS7
Also DIrectadmin is installed.

 

[NiteWave]

is it easy to reproduce the issue ?
you can log a ticket with us.

 

[Peps]

I'm not sure what causes it. This is a recently launched new VPS. The users are moved from an older VPS (also running litespeed). They are moved via the Directadmin export / import function.

I have a feeling it has something do to "private_html". As that is not being used anywhere, but it appears in all affected urls.

All websites have "Use a symbolic link from private_html to public_html - allows for same data in http and https"


All process contain "private_html":

lsphp:lve12/domains/aaaaa.eu/private_html/index.phto_avoid_overwrite_important_env
lsphp:lve12/domains/aaaaa.eu/private_html/index.phto_avoid_overwrite_important_env
lsphp:e12/domains/aaaaa.eu/private_html/wp-cron.phto_avoid_overwrite_important_env
lsphp:aaaaa.eu/private_html/wp-admin/admin-ajax.phto_avoid_overwrite_important_env

lsphp:bbbbb/domains/bbbbb.nl/private_html/index.phto_avoid_overwrite_important_env
lsphp:bbbbbb/domains/bbbbb.nl/private_html/index.phto_avoid_overwrite_important_env

lsphpmains/ccccc.nl/private_html/index.phto_avoid_overwrite_important_env

lsphp:mains/ddddd.nl/private_html/wp-cron.phto_avoid_overwrite_important_env

 

[NiteWave]

process manager

what is it ?
in command line, run "ps -ef|grep lsphp", can see "to_avoid_overwrite_important_env" ?

 

[Peps]

I get this:

 

[Peps]

> what is it ?
A directadmin page that lists the processes. Like:

 

[Attiqfsd]

Facing the same problem from today.

Server load increases A LOT and when I check it using htop, there are lots of this processes

lsphp:ains/mydomain.tld/private_html/index.phto_avoid_overwrite_important_env

I have DirectAdmin on Ubuntu 20.04 LTS with openlitespeed. All updated to latest version.

 

[NiteWave]

so this is DA specific process manager. not general one -- ps

have you asked DA ?

 

[Peps]

Sorry for the late reply, I did not receive an email notice of your reaction.

It seems it is not DA related. It also appears via SSH.

 

[Attiqfsd]

Sorry for the late reply, I did not receive an email notice of your reaction.

It seems it is not DA related. It also appears via SSH.

View attachment 2651

View attachment 2653

View attachment 2655

It could be a plugin hitting the MySQL via php. Ssh terminal is just another interface to manage the server. Check using query monitor plugin.

 

[Peps]

It could be a plugin hitting the MySQL via php. Ssh terminal is just another interface to manage the server. Check using query monitor plugin.

Have you found anything that way? Which plugin do you advise?

 

[Attiqfsd]

Have you found anything that way? Which plugin do you advise?

Not yet but I am still looking. Let me know if you find something lol

 

[Attiqfsd]

@Peps are you using LSCache plugin on the site which is causing high CPU usage? If yes, are you using Redis or memcached object caching?

 

[Peps]

- I don't have permanently high CPU usage any more. (In the beginning when I noticed it I manually killed those processes).
- Server has memcached and redis installed.
- Some websites use the LSCache plugin, some don't, some have it installed but disabled.
- The main weird things are still the 'private_html', while that folder is not used. And the added text: 'room_to_avoid_overwrite_important_env'.

'lsphp:xpo/domains/xxxx.nl/private_html/index.ph_room_to_avoid_overwrite_important_env'

 

[Attiqfsd]

private_html is just a symlink pointing towards public_html. I think it just means the problem is coming on https version of the site.

The 'room_to_avoid_overwrite_important_env' string is not very helpful, and there is literally nothing in google about it.

I just installed memcached and enabled object caching in LSCache plugin for the problem site. And the CPU usage is still spiking, it goes up randomly for 20 minutes and then comes back to normal.

When the CPU usage is spiking I checked running MySQL queries and it had a ton of the following query

SELECT post_id FROM postmeta WHERE meta_key = '_wp_attached_file' AND meta_value = '%site-logo.png%'

 

[NiteWave]

It seems it is not DA related. It also appears via SSH

the output is from "top". but I never see such output in "top" or "top -c". any special on your "top"?

'room_to_avoid_overwrite_important_env' should come from the process's env.
just "cat /proc/pid_of_lsphp_process/environ", you'll see "leave_some_room_to_avoid_overwrite_important_env" there

 

[Attiqfsd]

the output is from "top". but I never see such output in "top" or "top -c". any special on your "top"?

'room_to_avoid_overwrite_important_env' should come from the process's env.
just "cat /proc/pid_of_lsphp_process/environ", you'll see "leave_some_room_to_avoid_overwrite_important_env" there

Is there anyway to see what php script lsphp74 is running from the process id?

I am using htop and lsphp processes have the to_avoid string at the end

 

[Peps]

the output is from "top". but I never see such output in "top" or "top -c". any special on your "top"?

I ran "top -icd1"

you'll see "leave_some_room_to_avoid_overwrite_important_env" there

You have managed to reproduce it?