Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a PHP server running, with cron jobs etc... And once a day (between midnight and 3am), apache spawns one process that never ends. The server is a virtual server, so in a couple of days it eats up the whole memory.

Is there a way to figure out what is crashing ? What php script isn't finishing ? Or what url via apache was triggered ?

I have tried looking on the access logs, errors logs, but didn't find anything unusual.

Thank you

share|improve this question

migrated from Oct 6 '12 at 14:34

This question came from our site for professional and enthusiast programmers.

How do you know its started between midnight and 3am? Fact you seem to see one a day suggests its one of those CRON scripts. Do you do any logging with those? Sounds like a narrow enough field to find which one it is. – ficuscr Oct 5 '12 at 19:05
also 'lsof' command can be very useful to look what files has opened the proces – Jarry Oct 5 '12 at 19:21
I have ran "ps -aux" to see what time each process started, and each of the processes began between midnight and 3am. I have tried lsof, but haven't seen any useful information inside :(. – xtrimsky Oct 9 '12 at 20:20
Please add more details: Version of apache-httpd, what is your operating system, is the httpd part of your operating system, how did you install it? – Nils Oct 11 '12 at 20:47
up vote 1 down vote accepted

Go for /proc/$PID of that suspicious httpd-process and look into environ and cmdline. Do an ls -Fal of the fd subdirectory to see its active file-handles.

If this does not ring a bell - post the results as edit to your question.

share|improve this answer
Using your method I saw that there was a log file open inside fd with warnings inside for tomcat. I don't use tomcat, the only module I need is PHP. I also saw it loads Python etc... I disabled useless modules and I'll see how it works! Thanks. – xtrimsky Oct 15 '12 at 15:23

You can try enabling mod_status:

This will allow you to connect the PID and a request path of the offending script, and is also useful in just general admin.

If that's not enough to track down the culprit you might want to add a few logging statements to your jobs to help you track down where the script is looping and/or dying, or even attach a debugger if that tickles your fancy.

Also, like Jarry suggested, you can use lsof to determine what files/connections the process currently has open, which may give you a clue as to what it is trying to do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.