Big phpXXXXXX files in /home/USER/.cagefs/tmp

Hi all. I have some users with huge tmp files (between 500MB and 2GB): /home/$USER/.cagefs/tmp/phpXXXXXX I have other servers with the same issue. I do not know if this is the root of the issue but users bith bigger "phpXXXXXX" files are using Wordpress+plugins with php7. Any Ideas? Sistem info:


[root@server ~]# cat /etc/redhat-release
CloudLinux release 7.4 (Georgy Grechko)

CPanel 11.66.0.17


[root@server ~]# ls -larth /home/$USER/.cagefs/tmp/php*
-rw------- 1 $USER $USER 700M ago 24 10:47 /home/$USER/.cagefs/tmp/php3bLX6P
-rw------- 1 $USER $USER 752M ago 24 10:48 /home/$USER/.cagefs/tmp/phpyQVlXK
-rw------- 1 $USER $USER 1,2G ago 29 05:00 /home/$USER/.cagefs/tmp/phpTVL8ud
-rw------- 1 $USER $USER 1,2G ago 29 19:04 /home/$USER/.cagefs/tmp/phpEWRNjt
-rw------- 1 $USER $USER 1,2G ago 29 21:16 /home/$USER/.cagefs/tmp/php5IRtuJ
-rw------- 1 $USER $USER 1,1G ago 30 05:47 /home/$USER/.cagefs/tmp/phppCg2ag
-rw------- 1 $USER $USER 1,2G ago 30 15:31 /home/$USER/.cagefs/tmp/phpFvflBt
-rw------- 1 $USER $USER 1,2G ago 30 18:55 /home/$USER/.cagefs/tmp/phpl438Jl
-rw------- 1 $USER $USER 1,2G sep  1 04:40 /home/$USER/.cagefs/tmp/phpnvjn9N
-rw------- 1 $USER $USER 1,2G sep  1 05:06 /home/$USER/.cagefs/tmp/php5afzuV
-rw------- 1 $USER $USER 1,2G sep  1 11:52 /home/$USER/.cagefs/tmp/phpO427u7
-rw------- 1 $USER $USER 1,2G sep  1 14:39 /home/$USER/.cagefs/tmp/phpbRucIl
-rw------- 1 $USER $USER 1,2G sep  3 05:57 /home/$USER/.cagefs/tmp/phpie8a2k
-rw------- 1 $USER $USER 656M sep  3 16:23 /home/$USER/.cagefs/tmp/phpHNSknY
-rw------- 1 $USER $USER 818M sep  3 16:24 /home/$USER/.cagefs/tmp/php5H7kSj
-rw------- 1 $USER $USER 1,2G sep  3 17:41 /home/$USER/.cagefs/tmp/phpJiCASm

[root@server ~]# file /home/$USER/.cagefs/tmp/phpJiCASm /home/$USER/.cagefs/tmp/phpJiCASm: data


[root@server ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | head -n 20
is_editor_page/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b763f
tve_tcb__license_activated/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b773a
is_editor_page_raw/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b7988
tve_enqueue_editor_scripts/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9131
tve_enqueue_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b953f
tve_get_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9758
tve_get_style_family_class/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9900
OxK.
tve_change_style_family/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4b9af2
tve_load_custom_css/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba10e
tve_check_in_loop/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba2c1
tve_restore_script_tags_replace/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba400
tve_restore_script_tags/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba7ed
tve_get_thrive_optins/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4ba96e
tve_leads_additional_fields_filters/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bad75
tve_thrive_shortcodes/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bb9db
]ePK
tve_do_post_grid_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbb7b
tve_do_optin_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbd27
tve_do_posts_list_shortcode/home/$USER/public_html/wp-content/plugins/thrive-visual-editor/inc/functions.php0x7f099c4bbe5e


[root@server ~]# strings /home/$USER/.cagefs/tmp/phpJiCASm | tail -n 20
LIKE
LEFT
LEAVE
LEADING
KILL
KEYS
rules
scanner
subject
T_COMMA
T_COMMA
T_DOT
T_DOT
filters
/\]/
/\[/
getWAF
setWAF
/\)/
/\(/

Eminds

September 05, 2017 01:55

most probably these are cache files generated by the wordpress cache plugins, once the cache is cleared the files should be removed.

24x7server

September 05, 2017 05:16

Hi, Check the below link, which refer to the same issue you are facing.. User's .cagefs/tmp/ directory filling with thousands of session files

rarod

September 05, 2017 16:50

I correlated some dates from a strace and pointed to this lines in apache error_log: [Tue Sep 05 13:54:34.492388 2017] [lsapi:error] [pid 24925] [client ip-edited:54084] [host www.domain-edited.com] get_client_block(16384) failed, referer: www.domain-edited.com] Client error on sending request(POST /wp-admin/admin-ajax.php HTTP/1.1); uri(/wp-admin/admin-ajax.php) content-length(735): user_get_body(tmpstackbuf, 16384): read from client failed, referer: User's .cagefs/tmp/ directory filling with thousands of session files
Not the same issue, but thanks anyway.

I already think in cache problems, but at the time I got nothing clear. Thanks.

cPanelMichael

September 06, 2017 16:55

Hello, CloudLinux documents the CageFS tmp directory, including steps to manually clean up temporary files, at: CloudLinux Documentation Could you let us know if that helps to clear these files? Thank you.

September 07, 2017 14:53

I traced the issue down to the wordfence plugin. But I do not know why it is creating such big tmp files. With high php max_execution_time and high lsapi lsapi_backend_max_process_time this tmp files appears to grow infinitely.

September 07, 2017 17:01

You may also want to reach out to CloudLinux directly for their feedback on this topic since the issue relates to CageFS: CloudLinux - Contact Support Thank you.

Big phpXXXXXX files in /home/USER/.cagefs/tmp

Comments

Didn't find what you were looking for?