Websites on PHP-FPM are not available and there is a php-fpm process that consumes 100% CPU on Plesk server

Plesk for Linux kb: technical ABT: Group B

Applicable to:

Websites are not available.
Some websites are downloaded instead of displaying the content.
There are stuck php-fpm processes that consume 100% CPU:

# top -c

Tasks: 1200 gesamt, 2 laufend, 1198 schlafend, 0 gestoppt, 0 Zombie
%CPU(s): 2.6 be, 10.0 sy, 0.0 ni, 87.3 un, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
<...>

PID USER PR NI VIRT RES SHR S %CPU %MEM ZEIT+ BEFEHL
39053 web69 20 0 427260 16288 7240 R 100.0 0.1 191:34.18 php-fpm: pool example.com
Restart of the PHP-FPM service fixes the issue.
The strace utility to the php-fpm process shows the following output:

# strace -p39053

strace: Process 39053 attached
kill(39005, SIGKILL) = -1 EPERM (Operation not permitted)
fcntl(4, F_GETLK, {l_type=F_RDLCK, l_whence=SEEK_SET, l_start=1, l_len=1, l_pid=39005}) = 0
kill(39005, SIGKILL) = -1 EPERM (Operation not permitted)
fcntl(4, F_GETLK, {l_type=F_RDLCK, l_whence=SEEK_SET, l_start=1, l_len=1, l_pid=39005}) = 0
kill(39005, SIGKILL) = -1 EPERM (Operation not permitted)
fcntl(4, F_GETLK, {l_type=F_RDLCK, l_whence=SEEK_SET, l_start=1, l_len=1, l_pid=39005}) = 0
kill(39005, SIGKILL) = -1 EPERM (Operation not permitted) \
The following error appears is PHP-FPM error log, for example in the /var/log/plesk-php72-fpm/error.log file:

CONFIG_TEXT: WARNING: [pool example.com] child 5023 said into stderr: "(5023): Error Cannot kill process 2349: Operation not permitted!"

This is a PHP-FPM bug #74709.

There are several workarounds for the issue available when logged in to Plesk:

Disable OPCache module for the required PHP version:

Log in to Plesk.

Note: change the "X.X.X PHP handler" to the correct PHP version.
Go to Tools & Settings > PHP Settings > X.X.X PHP application
Uncheck the opcache checkbox and press the OK button.

If OPCache is necessary, switch the domains to another PHP handler, e.g. to FastCGI:

For many domains it is recommended to manage PHP handler via a service plan.

For locked subscriptions, changes have to be done per subscription.

All cases are described in the following article:

Forbid calling the "kill_all_lockers" function

Note: it is not possible to manage the disable_functions directive via the php.ini configuration file, because Plesk will overwrite them.

For a service plan:
1. Log in to Plesk.
2. Go to Service Plans > Default > PHP Settings.
  
  Note: change the "Default" service plan name in the path above to the correct one.
3. Add the following value at the end of the disable_functions field:
  
  CONFIG_TEXT: kill_all_lockers
4. Navigate to the Permissions tab and make sure that the Hosting settings management and Common PHP settings management permissions are not granted, otherwise, PHP settings will not be applied.
5. Press the Update & Sync button.
For subscription and for locked subscriptions:
1. Log in to Plesk.
2. Go to Subscriptions > example.com > PHP Settings.
3. Add the following value at the end of the disable_functions field:
  
  CONFIG_TEXT: kill_all_lockers
4. Click the OK button.