Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I find a CGI process running with apache2:

# ps axf
...
30161 ?        Ss     0:02 /usr/sbin/apache2 -k start
30164 ?        S      0:00  \_ /usr/sbin/apache2 -k start
 2900 ?        S      5:41  |   \_ python /opt/demo/cgi-bin/cdn.cgi
30334 ?        Sl     0:13  \_ /usr/sbin/apache2 -k start
30335 ?        Sl     0:16  \_ /usr/sbin/apache2 -k start
 8920 ?        Sl     0:15  \_ /usr/sbin/apache2 -k start
...

Strace shows the process is writing a lot of data continually to its stdout:

# strace -p 2900
...
write(1, "80\r\n\346\377\235\377\327\377\220\0\25\1x\0\322\3771\0n\0{\0\177\0003\0'\0X\0"..., 134) = 134
write(1, "80\r\nI\0R\0]\0v\0\246\0\320\0\226\0/\0\221\0\364\0\310\0\221\0\204\0\366\0"..., 134) = 134
write(1, "80\r\n\34\0006\0\362\377\"\0\32\0\236\377R\377\307\377\17\0\231\377\321\377\366\377\345\377F\0"..., 134) = 134
write(1, "80\r\n\374\377\362\377,\377\246\3777\0000\0'\0\345\377\363\377'\0d\0_\0\26\0\263\377"..., 134) = 134
write(1, "80\r\n\323\377\362\377*\0\245\377\267\377\312\0\5\1\225\0U\0R\0'\0\n\0b\0\n\0"..., 134) = 134
write(1, "80\r\n\325\376F\377\324\377\336\377\361\377\r\0}\0p\0\374\377\221\0\334\0\265\0\372\0\255\0"..., 134) = 134
write(1, "80\r\n\7\371L\371\277\375\\\3;\7\305\4\16\375\340\370\315\373y\1\200\5\235\5\255\1f\374"..., 134) = 134
write(1, "80\r\nd\2\213\1`\0\227\0\30\1\245\0\v\377p\377\304\377\351\377\325\1T\2\253\1|\0"..., 134) = 134
write(1, "80\r\nw\3\226\0\212\376\221\375w\0\201\3\26\2\355\377v\374\37\374\36\0y\2&\4w\5"..., 134) = 134
write(1, "80\r\n\347\0l\1\331\3\4\377@\373\31\2^\3$\377\227\0\37\0\326\377\224\0\35\4\324\3"..., 134) = 134
write(1, "80\r\n\17\0\25\0\224\375Y\0Y\377Q\375\372\1`\0x\376\267\0\223\0\205\377\303\1\236\2"..., 134) = 134
write(1, "80\r\n\250\0\226\375\310\372q\375\v\375\215\374$\2\300\2!\0\227\377\317\376\332\376\4\376\344\0"..., 134) = 134
write(1, "80\r\n\257\0036\0\323\3|\377;\0\240\5\343\1\233\3\346\2\n\376\321\1j\3\f\2\6\3"..., 134) = 134
write(1, "80\r\n`\10 \10\256\1\206\2\227\0045\2\341\7{\nC\n0\17\365\n\272\5\223\6\201\4"..., 134) = 134
write(1, "80\r\n\277\10E\4\37\7+\f|\20\327\26\222\32k\26\371\r\270\6r\0\310\371\230\373\377\376"..., 134) = 134
write(1, "80\r\nn\375-\373\231\376\210\6b\10\234\1\211\372\234\370\346\365\32\372\217\4e\5\316\1\224\0"..., 134) = 134
write(1, "80\r\n\255\1\215\377\34\1S\2\367\2j\0U\367\32\356\225\356p\365N\371\33\373\315\373Q\371"..., 134) = 134
write(1, "80\r\nJ\367d\371-\376\267\377\303\0\351\375\26\367\356\363\7\370\222\372Z\3671\364+\360\213\360"..., 134) = 134
write(1, "80\r\n\314\362O\366\372\370_\374;\0\356\0\325\1C\10\211\v\322\r\341\26\216\31c\0245\17"..., 134) = 134
write(1, "80\r\n\226\21\311\22h\n\263\1\v\1\351\6@\f\323\v\220\7o\2\241\377:\0=\1\300\0"..., 134) = 134
write(1, "80\r\n\321\16\207\v\7\1\177\374A\1]\2\300\376#\371\242\360A\360\322\367\t\375\24\1^\1"..., 134) = 134
write(1, "80\r\n\21\16\375\t\303\376o\0\307\v\230\n0\3779\361d\352{\362}\374V\374\277\362O\362"..., 134) = 134
write(1, "80\r\ns\375\343\366]\367\306\374\332\1\10\3\2\376\332\367\335\366E\372\253\371G\361\353\353;\357"..., 134) = 134
write(1, "80\r\n\25\364\355\364d\366A\360\331\354/\364\235\373\341\373\256\373o\372F\371\37\0T\t\362\t"..., 134) = 134
write(1, "80\r\ni\375\344\371\324\3728\3\271\7\360\5J\3S\2L\0058\n\23\t\t\0027\0\247\4"..., 134) = 134
write(1, "80\r\nM\5\334\7\240\2o\376.\2\265\0077\10\265\5,\3\200\1:\4\304\6\200\3w\5"..., 134) = 134
write(1, "80\r\n\226\6\270\1\0\2\f\7\263\7\332\3\30\2\246\0\232\2\225\t\314\nO\3\231\2\32\16"..., 134) = 134
write(1, "80\r\n\374\10\246\7\211\5\327\6\200\7\26\6\26\4s\1\217\376\213\377\1\4M\7^\7\17\7"..., 134) = 134
write(1, "80\r\n\22\0\374\4{\t9\t\230\6\332\6\255\10\375\7\252\5\242\3p\2:\3\22\4]\2"..., 134) = 134
write(1, "80\r\nM\372\246\373{\374\202\377d\3@\7\25\nz\n_\n\260\n\217\t\360\5\314\2U\3"..., 134) = 134
...

And lsof shows the stdout of CGI process is connected to a UNIX socket:

# lsof -p 2900
...
python  2900 www-data  mem    REG              202,1    14768    393325 /lib/x86_64-linux-gnu/libdl-2.13.so
python  2900 www-data  mem    REG              202,1   131107    393322 /lib/x86_64-linux-gnu/libpthread-2.13.so
python  2900 www-data  mem    REG              202,1   136936    393756 /lib/x86_64-linux-gnu/ld-2.13.so
python  2900 www-data    0u  unix 0xffff880068638f00      0t0 385857668 /var/run/apache2/cgisock.30161
python  2900 www-data    1u  unix 0xffff880068638f00      0t0 385857668 /var/run/apache2/cgisock.30161
python  2900 www-data    2w   REG              202,1   160579    138477 /var/log/apache2/error.log
python  2900 www-data    3r  0000                0,9        0      2226 anon_inode
python  2900 www-data    4u  unix 0xffff88000312c3c0      0t0 378568831 /var/run/apache2/cgisock.30161

We can find that the socket path is /var/run/apache2/cgisock.30161 and the No.1 fd and No.4 fd are both connected to this socket. Then first question is: I can understand that the CGI process reads HTTP request data from the socket and write response data to the same socket, but what about the No.4 fd? How does it happen and what does it mean?

Then I run lsof with the socket:

# lsof /var/run/apache2/cgisock.30161
COMMAND   PID     USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
python   2900 www-data    0u  unix 0xffff880068638f00      0t0 385857668 /var/run/apache2/cgisock.30161
python   2900 www-data    1u  unix 0xffff880068638f00      0t0 385857668 /var/run/apache2/cgisock.30161
python   2900 www-data    4u  unix 0xffff88000312c3c0      0t0 378568831 /var/run/apache2/cgisock.30161
apache2 30164 www-data    4u  unix 0xffff88000312c3c0      0t0 378568831 /var/run/apache2/cgisock.30161

We can find there's an apache2 process whose pid is 30164 accessing the socket. And the apache2 process with pid is the parent process of the CGI process tree according to the ps info which is shown at the begging of the post.

I straced the apache2 process:

# strace -p 30164
Process 30164 attached - interrupt to quit
accept(4, 

It shows that the apache2 process is stopped at accept system call. It means the process is waiting for connection from the No.4 socket which is connected to the UNIX socket shown above:

# lsof -p 30164
...
apache2 30164 www-data    0r   CHR                1,3      0t0         7 /dev/null
apache2 30164 www-data    1w   CHR                1,3      0t0         7 /dev/null
apache2 30164 www-data    2w   REG              202,1   160579    138477 /var/log/apache2/error.log
apache2 30164 www-data    3u  sock                0,7      0t0 378567690 can't identify protocol
apache2 30164 www-data    4u  unix 0xffff88000312c3c0      0t0 378568831 /var/run/apache2/cgisock.30161
apache2 30164 www-data    5r  FIFO                0,8      0t0 378568826 pipe
...

I can find not find anything to prove the apache2 process is reading from the socket. The second question is who is reading the UNIX socket while the CGI process(pid:2900) is writing.

I checked TCP connections with apache2, but no one is requesting the CGI. I can imagine someone accessed the CGI and left before it finishes to response. But it raised me the last question: Why does the CGI process still running after the remote client gone ?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.