1

Problem

I have by mistake initiated a PHP background process script that calls itself and has now created an infinite loop of calling itself over and over. It currently sends an email to my Gmail account, and I get tons of e-mails. The PHP script uses cURL to call itself recursively (using the PHP exec() function).

When I run ps faux I see a tremendous amount of Apache child processes, and I can't seem to kill those off.

What I've tried

  • I've tried stop these processes with kill <pid> but it doesn't seem to help - new ones pops up after this
  • I've tried killing these processes with killall -9 httpd, which kills all these processes, but it also terminates the main httpd WebServer process itself, and when I start that process again all of these looping php/apache processes are back.
  • Removed the PHP script itself completely from the WebServer, does not affect this at all
  • Restarted the VPS

Any ideas in what to try next?


UPDATE: Here is the code:

example.com -> /var/www/site1/index.php:

<?php

require_once "processor.php";

<html>
...

/var/www/site1/processor.php:

<?php

if (isset($_POST['test]) && $_POST['test] == 1) {
  // send an e-mail to my Gmail account
}

run_background_process('example.com', 'test=1');
    
function run_background_process($url, $params) {

  // do a normal cURL POST
  $cmd = 'curl -X POST ';
  // append the URL to the script
  $cmd .= $url;
  // add any variables that needs to be passed to the target script
  $cmd .= ' -d "' . $params . '"';
  // run it in the background so it does not affect page load
  $cmd .= " > /dev/null 2>&1 &"; 
  // execute
  exec($cmd, $output, $exit); 
  return $exit == 0;

}

UPDATE: Additional things I've now tried:

  • reset Apache and PHP configurations (removed all Apache VHosts)

  • restarted the VPS multiple times

Nothing has killed these stubborn processes off so far


UPDATE: This is how the process table looks like when running ps faux:

root      1305  1.0  1.1  39444 12096 ?        Ss   13:38   0:00 /usr/sbin/httpd
apache    1307  0.0  0.5  39444  6192 ?        S    13:38   0:00  \_ /usr/sbin/httpd
apache    ...   ...  ...  .....  .... .        .    .....   ....  \_ /usr/sbin/httpd

It's that second line and downards I want to terminate once and for all.


UPDATE: Question: Perhaps these re-occuring httpd tasks coming from a cache location of some sort? Meaning these tasks exist / are stacked up in some cache/tmp environment?


UPDATE: Here is the result of netstat -tlpan (masked out the IPs with x)

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      900/sendmail
tcp        0      0 x.x.x.x:8000                0.0.0.0:*                   LISTEN      22457/httpd
tcp        0      0 0.0.0.0:7648                0.0.0.0:*                   LISTEN      554/sshd
tcp        0      0 0.0.0.0:1345                0.0.0.0:*                   LISTEN      949/perl
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      836/mysqld
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      22457/httpd
tcp        0     64 x.x.x.x:7648                x.x.x.x:56524       ESTABLISHED 27410/sshd
tcp        0      0 :::7648                     :::*                        LISTEN      554/sshd

UPDATE: Could this perhaps be a bug in Apache / httpd itself? As killing the Apache service once should kill off all child processes for good.

13
  • You say removing the script doesn't help, I would expect that to be the case, what was the php script designed to do? Jan 15, 2018 at 17:50
  • It was just a bad php script test on my part -- basically it's designed to check a folder, and if that folder contains any files, move those files to a different location. I'm gonna update the question above with the code
    – camursm
    Jan 15, 2018 at 18:00
  • And after removing script how do you know it's still running? Those processes might be orphaned from that original script parent process. Jan 15, 2018 at 18:14
  • When I check the process list with ps fuax I see lots and lots of httpd child processes, and also I get hundreds upon hundreds of e-mals to my Gmail account (I didn't include the mail code in the example code above)
    – camursm
    Jan 15, 2018 at 18:17
  • Ok run ps aux | grep Z to spot any zombies! Jan 15, 2018 at 18:18

1 Answer 1

0

Correct your code:

Looking at your code (thanks for supplying it now) you seem to be missing an else - depending on what you wish to do, of course, as we have no requirement specification.

If you only wish to spawn 1 background process, try this:

<?php

if (isset($_POST['test']) && $_POST['test'] == 1) {
  // send an e-mail to my Gmail account
}
else
  run_background_process('example.com', 'test=1');

(...)

Otherwise you will call all of your code again after sending each e-mail.

(Your original code also contained too few single quotes ´ in the if statement which I assume are there in your file, just not on your question - unless php is even more generous with its syntax than I thought.)

Workaround to stop the spawned processes:

Try this to kill

ps aux | grep -w httpd | grep -v grep | awk '{print $2}' | xargs --no-run-if-empty kill -KILL

or to suspend (stop) the processes:

ps aux | grep -w httpd | grep -v grep | awk '{print $2}' | xargs --no-run-if-empty kill -STOP
13
  • Many thanks for the idea. I tried the first command, it successfully kills the processes, but that includes the main Apache/httpd service itself. And when I start the service back with "service httpd start", a big pile of httpd child processes re-appears
    – camursm
    Jan 15, 2018 at 20:26
  • I've also tried targeting and killing subproceses specifically, with "pkill -u apache", but as soon as I've get the processes purged, new ones appear
    – camursm
    Jan 15, 2018 at 20:27
  • Maybe this could be solved if I purge and reinstall the Apache/HTTPD service altogether?
    – camursm
    Jan 15, 2018 at 20:28
  • Or, perhaps these re-occuring httpd tasks coming from a cache location of some sort? Meaning these tasks exist / are stacked up in some cache/tmp environment?
    – camursm
    Jan 15, 2018 at 20:32
  • Normally apache by itself spawns worker processes (and you can control the number of total/spare ones) but no php code is run without an external call. That is why I requested the netstat output.
    – Ned64
    Jan 16, 2018 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .