PHP exec "unable to fork" intermittent error on CentOS VPS

Question

Using:

PHP 5.5.10
nginx 1.5.10
Centos 6.5

a xen-based 4GB VPS

My site uses encrypted paypal buttons. This encryption is done by the following code:

$openssl_cmd = "($OPENSSL smime -sign -signer $MY_CERT_FILE -inkey $MY_KEY_FILE " .
               "-outform der -nodetach -binary <<_EOF_\n$data\n_EOF_\n) | " .
               "$OPENSSL smime -encrypt -des3 -binary -outform pem $PAYPAL_CERT_FILE";

exec($openssl_cmd, $output, $error);

A couple of times now (a few days apart) the buttons have started to fail to encode. If I run "service php-fpm restart" then everything is fine again.

This is the error given:

PHP Warning:  exec(): Unable to fork [(/usr/bin/openssl smime -sign 
    -signer /var/www/my-pubcert.pem -inkey /var/www/my-prvkey.pem -outform der 
    -nodetach -binary <datasnipped>) | /usr/bin/openssl smime -encrypt -des3 
    -binary -outform pem /var/www/paypal_cert.pem]

Once it happens it seems to happen constantly until I restart php-fpm.

Any ideas what route I should go down to debug/fix this?

Thanks

Solution 1

Most likely the PHP processes start using a lot of memory at some point (you can check that in top, press M to sort the processes by memory). Try setting "pm.max_requests = 100" or, anyway, a much lower value of what you have now (or, around 100 or so if it is 0, which means infinite).

By the way, a much better approach to your encryption would be to use the PHP OpenSSL library rather than executing the command line interface of OpenSSL.

Edit:

At your request (even if it is partially off-topic), you can find documentation and example code for the 2 OpenSSL functions in PHP here and here. You may need to recompile PHP with OpenSSL support or install the required module (normally it should have it built in).

Solution 2

I'd take a look at how many file handles you have open, and what the max is set to. sysctl fs.file-nr is a good place to start. If the first number is close to the last, you're running out of file handles! you can up them by setting it in systcl.conf, or by sysctl -w fs.file-max=100000. If this is the case, I'd look elsewhere in your code for why file handles anrent being closed.

Comments

[Matthew Ife]

How many child processes do you spawn with php-fpm and what is your maximum?

[Codemonkey]

I would very much rather do this inside PHP than using exec - could you link me to some example code to get me started? Thanks! In the meantime I've just discovered the php-fpm status page, so I will be keeping an eye on that and will see what's going on there.

[Codemonkey]

Thanks for those links. I've implemented that now and done some simple ab benchmarking and the php implementation slows the page from 100ms average to 500ms, so I might have to discount that option. A shame, but I guess not entirely unexpected.

[Ligemer]

Downvote with no comment?