1

Problem

I have by mistake initiated a PHP background process script that calls itself and has now created an infinite loop of calling itself over and over. It currently sends an email to my Gmail account, and I get tons of e-mails. The PHP script uses cURL to call itself recursively (using the PHP exec() function).

When I run ps faux I see a tremendous amount of Apache child processes, and I can't seem to kill those off.

What I've tried

  • I've tried stop these processes with kill <pid> but it doesn't seem to help - new ones pops up after this
  • I've tried killing these processes with killall -9 httpd, which kills all these processes, but it also terminates the main httpd WebServer process itself, and when I start that process again all of these looping php/apache processes are back.
  • Removed the PHP script itself completely from the WebServer, does not affect this at all
  • Restarted the VPS

Any ideas in what to try next?


UPDATE: Here is the code:

example.com -> /var/www/site1/index.php:

<?php

require_once "processor.php";

<html>
...

/var/www/site1/processor.php:

<?php

if (isset($_POST['test]) && $_POST['test] == 1) {
  // send an e-mail to my Gmail account
}

run_background_process('example.com', 'test=1');

function run_background_process($url, $params) {

  // do a normal cURL POST
  $cmd = 'curl -X POST ';
  // append the URL to the script
  $cmd .= $url;
  // add any variables that needs to be passed to the target script
  $cmd .= ' -d "' . $params . '"';
  // run it in the background so it does not affect page load
  $cmd .= " > /dev/null 2>&1 &"; 
  // execute
  exec($cmd, $output, $exit); 
  return $exit == 0;

}

UPDATE: Additional things I've now tried:

  • reset Apache and PHP configurations (removed all Apache VHosts)

  • restarted the VPS multiple times

Nothing has killed these stubborn processes off so far


UPDATE: This is how the process table looks like when running ps faux:

root      1305  1.0  1.1  39444 12096 ?        Ss   13:38   0:00 /usr/sbin/httpd
apache    1307  0.0  0.5  39444  6192 ?        S    13:38   0:00  \_ /usr/sbin/httpd
apache    ...   ...  ...  .....  .... .        .    .....   ....  \_ /usr/sbin/httpd

It's that second line and downards I want to terminate once and for all.


UPDATE: Question: Perhaps these re-occuring httpd tasks coming from a cache location of some sort? Meaning these tasks exist / are stacked up in some cache/tmp environment?


UPDATE: Here is the result of netstat -tlpan (masked out the IPs with x)

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      900/sendmail
tcp        0      0 x.x.x.x:8000                0.0.0.0:*                   LISTEN      22457/httpd
tcp        0      0 0.0.0.0:7648                0.0.0.0:*                   LISTEN      554/sshd
tcp        0      0 0.0.0.0:1345                0.0.0.0:*                   LISTEN      949/perl
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      836/mysqld
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      22457/httpd
tcp        0     64 x.x.x.x:7648                x.x.x.x:56524       ESTABLISHED 27410/sshd
tcp        0      0 :::7648                     :::*                        LISTEN      554/sshd

UPDATE: Could this perhaps be a bug in Apache / httpd itself? As killing the Apache service once should kill off all child processes for good.

  • You say removing the script doesn't help, I would expect that to be the case, what was the php script designed to do? – George Udosen Jan 15 '18 at 17:50
  • It was just a bad php script test on my part -- basically it's designed to check a folder, and if that folder contains any files, move those files to a different location. I'm gonna update the question above with the code – camursm Jan 15 '18 at 18:00
  • And after removing script how do you know it's still running? Those processes might be orphaned from that original script parent process. – George Udosen Jan 15 '18 at 18:14
  • When I check the process list with ps fuax I see lots and lots of httpd child processes, and also I get hundreds upon hundreds of e-mals to my Gmail account (I didn't include the mail code in the example code above) – camursm Jan 15 '18 at 18:17
  • Ok run ps aux | grep Z to spot any zombies! – George Udosen Jan 15 '18 at 18:18
0

Correct your code:

Looking at your code (thanks for supplying it now) you seem to be missing an else - depending on what you wish to do, of course, as we have no requirement specification.

If you only wish to spawn 1 background process, try this:

<?php

if (isset($_POST['test']) && $_POST['test'] == 1) {
  // send an e-mail to my Gmail account
}
else
  run_background_process('example.com', 'test=1');

(...)

Otherwise you will call all of your code again after sending each e-mail.

(Your original code also contained too few single quotes ´ in the if statement which I assume are there in your file, just not on your question - unless php is even more generous with its syntax than I thought.)

Workaround to stop the spawned processes:

Try this to kill

ps aux | grep -w httpd | grep -v grep | awk '{print $2}' | xargs --no-run-if-empty kill -KILL

or to suspend (stop) the processes:

ps aux | grep -w httpd | grep -v grep | awk '{print $2}' | xargs --no-run-if-empty kill -STOP
  • Many thanks for the idea. I tried the first command, it successfully kills the processes, but that includes the main Apache/httpd service itself. And when I start the service back with "service httpd start", a big pile of httpd child processes re-appears – camursm Jan 15 '18 at 20:26
  • I've also tried targeting and killing subproceses specifically, with "pkill -u apache", but as soon as I've get the processes purged, new ones appear – camursm Jan 15 '18 at 20:27
  • Maybe this could be solved if I purge and reinstall the Apache/HTTPD service altogether? – camursm Jan 15 '18 at 20:28
  • Or, perhaps these re-occuring httpd tasks coming from a cache location of some sort? Meaning these tasks exist / are stacked up in some cache/tmp environment? – camursm Jan 15 '18 at 20:32
  • Normally apache by itself spawns worker processes (and you can control the number of total/spare ones) but no php code is run without an external call. That is why I requested the netstat output. – Ned64 Jan 16 '18 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.