Bug#668597: [php-maint] Bug#668597: php5 creates weird files in /
The effect is perfectly reproducible, but only on those two systems. Even with the exact same apache and php configs I cannot reproduce the effect on a third computer, though. Unfortunately I cannot recreate the exact same set of packages there at the moment. Steps are as follows: 1. Change the comment sign to '#' in /etc/php5/apache2/conf.d/apc.ini 2. Do "/etc/init.d/apache2 reload" (not "restart") Then the file appears and the following lines show up in /var/log/apache2/error.log [Tue May 22 20:51:32 2012] [notice] Graceful restart requested, doing restart [Tue May 22 20:51:32 2012] [error] (9)Bad file descriptor: apr_socket_accept: (client socket) [Tue May 22 20:51:32 2012] [notice] Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o configured -- resuming normal operations That is interesting. When I do a "restart" the strange file is not created and instead those lines show up there: Tue May 22 20:52:57 2012] [notice] caught SIGTERM, shutting down PHP Deprecated: Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0 [Tue May 22 20:52:58 2012] [notice] Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o configured -- resuming normal operations The problem might have something to do with this: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/174805 - at least it creates the same error message. The third computer where it doesn't happen also listens on ports 80 and 443, though. And I don't see any hung processes anywhere. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: [php-maint] Bug#668597: php5 creates weird files in /
> last shot - is your filesystem health ok? > It happens on two virtual machines running on the same host server. They're similar but it seems unlikely that they'd suddenly both develop the same defect in their file systems. Obviously the problem is that PHP doesn't know where to put its logs when parsing that deprecated '#'. Then it probably uses some uninitialized data as file name, opens the file associated with that and puts them there. This is nasty. Someone could make the OS allocate a big chunk of memory and repeatedly write '/etc/passwd', then deallocate it and wait for the OS to give some part of that chunk to PHP. Chances are that it would overwrite /etc/passwd then. I have specified a file as error_log in /etc/php5/apache2/php.ini and it seems to ignore it: error_log = "/var/log/php_error.log" Should it write those things to the error log? Or where would they normally end up? I'll do some more experiments tonight. Please don't close the bug, yet. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: [php-maint] Bug#668597: php5 creates weird files in /
Hi Ulf, last shot - is your filesystem health ok? I don't think this is a bug in the php5 itself, but a manifestation of some other problem on your system. O. On Fri, Apr 13, 2012 at 12:00 PM, Ulf Hermann wrote: > Package: php5 > Version: 5.3.3-7+squeeze8 > Severity: normal > > > Today I found the following files in / > > root@devs:~# ls / > ?? ?? bin ? media opt proc sbin srv tmp ???u?? usr vmlinuz > ?ʺ??? ?;?? boot ??:?d? dev home initrd.img lib lost+found mnt > P? root selinux sys ???u?? ???u?? var ?w?ƥ? > root@ > > After renaming them I found the following contents: > > root@devs:/# cat baum* > [11-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [25-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [01-Apr-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [...] > > As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that > makes me suspect a bug in PHP here. > > -- System Information: > Debian Release: 6.0.4 > APT prefers stable > APT policy: (500, 'stable') > Architecture: amd64 (x86_64) > > Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core) > Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > > Versions of packages php5 depends on: > ii libapache2-mod-php5 5.3.3-7+squeeze8 server-side, HTML-embedded > scripti > ii php5-common 5.3.3-7+squeeze8 Common files for packages built > fr > > php5 recommends no packages. > > php5 suggests no packages. > > -- no debconf information > > > > ___ > pkg-php-maint mailing list > pkg-php-ma...@lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint -- Ondřej Surý -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: php5 creates weird files in /
> What were the timestamps on those files that you found in / from this > event? Were they current with a similar timestamp to the messages > you share below? Or were they much older? Could this have been > something that happened a long time ago? Or is this something that > is continuing to happen daily? > I'll just attach all of those files (renamed, though, and in no particular order), then you can see for yourself. It didn't happen every sunday, but almost and some are on other times. The sunday thing correlates with the logrotate cronjob I posted before. There's no other cronjob running in the daily schedule (at 6:25), but only ever does anything on sunday. The files contain the deprecation messages. > The timestamps above show that it has been happening not quite > weekly. It looks like it skipped a week on the 18th. But has > otherwise been happening on Sunday. That could be a clue to find the > cron task that runs weekly on Sunday to find what has been happening. > > Those init files are part of the php-apc package. What is the status > of that package on your system? Is it installed or removed? > > dpkg -l php-apc > It's installed, but disabled via the deprecated '#' in /etc/php5/apache2/conf.d/apc.ini the message is complaining about: ii php-apc 3.1.3p1-2 APC (Alternative PHP Cache) module for PHP 5 > Could you look through the cron scripts that run weekly and try to > find what might be running at that time? > I already did that. The regular weekly scripts run at 6:47, only daily scripts run at 6:25. Of those only the apache logrotate has that behavior of only actually doing anything on sunday. So maybe it's a logrotate issue after all. Maybe logrotate cannot handle error messages from postrotate scripts. However, that wouldn't explain the occurences on non-sundays. Ulf bug.tar.gz Description: GNU Zip compressed data
Bug#668597: php5 creates weird files in /
Ulf Hermann wrote: > ??? ??? bin ? proc sbin srv tmp ???u?? usr vmlinuz > ?ʺ??? ?;??boot ??:?d? dev home initrd.img liblost+found mnt > P??? root selinux sys ???u?? ???u?? var ?w?ƥ? What were the timestamps on those files that you found in / from this event? Were they current with a similar timestamp to the messages you share below? Or were they much older? Could this have been something that happened a long time ago? Or is this something that is continuing to happen daily? > [11-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0 > [25-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0 > [01-Apr-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0 > [...] The timestamps above show that it has been happening not quite weekly. It looks like it skipped a week on the 18th. But has otherwise been happening on Sunday. That could be a clue to find the cron task that runs weekly on Sunday to find what has been happening. Those init files are part of the php-apc package. What is the status of that package on your system? Is it installed or removed? dpkg -l php-apc > As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that > makes me suspect a bug in PHP here. I have two suspicions. One is that an older version of the php-apc package may have been installed at one time and then subsequently removed but not purged leaving the conffiles in /etc around. I suspect that there may be something in those left behind files that are interacting. My second is that there is a cron task script that we are not seeing that is perhaps a local script not from any package that is causing this. Could you look through the cron scripts that run weekly and try to find what might be running at that time? Bob -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: [php-maint] Bug#668597: php5 creates weird files in /
>
> I don't think the PHP is here at fault. I looks like some script is
> calling php (maybe a cron job?) and redirecting output to a random
> files in root directory.
It has an interesting correlation with logrotate as most (but not all)
of the files were created when apache logs were rotated and the
logrotate script indeed reloads the apache config:
root@devs:~# cat /etc/logrotate.d/apache2
/var/log/apache2/*.log {
weekly
missingok
rotate 52
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
postrotate
/etc/init.d/apache2 reload > /dev/null
endscript
}
However, I can't really see why this should spit out random files in / .
All other cron jobs seem unrelated.
Ulf
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: [php-maint] Bug#668597: php5 creates weird files in /
Hi Ulf, I don't think the PHP is here at fault. I looks like some script is calling php (maybe a cron job?) and redirecting output to a random files in root directory. Ondrej On Fri, Apr 13, 2012 at 12:00, Ulf Hermann wrote: > Package: php5 > Version: 5.3.3-7+squeeze8 > Severity: normal > > > Today I found the following files in / > > root@devs:~# ls / > ?? ?? bin ? media opt proc sbin srv tmp ???u?? usr vmlinuz > ?ʺ??? ?;?? boot ??:?d? dev home initrd.img lib lost+found mnt > P? root selinux sys ???u?? ???u?? var ?w?ƥ? > root@ > > After renaming them I found the following contents: > > root@devs:/# cat baum* > [11-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [25-Mar-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [01-Apr-2012 06:25:06] PHP Deprecated: Comments starting with '#' are > deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on > line 0 > [...] > > As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that > makes me suspect a bug in PHP here. > > -- System Information: > Debian Release: 6.0.4 > APT prefers stable > APT policy: (500, 'stable') > Architecture: amd64 (x86_64) > > Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core) > Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > > Versions of packages php5 depends on: > ii libapache2-mod-php5 5.3.3-7+squeeze8 server-side, HTML-embedded > scripti > ii php5-common 5.3.3-7+squeeze8 Common files for packages built > fr > > php5 recommends no packages. > > php5 suggests no packages. > > -- no debconf information > > > > ___ > pkg-php-maint mailing list > pkg-php-ma...@lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint -- Ondřej Surý -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#668597: php5 creates weird files in /
Package: php5 Version: 5.3.3-7+squeeze8 Severity: normal Today I found the following files in / root@devs:~# ls / ?? ?? bin ?
