Applicable to:
- Plesk for Linux
Symptoms
PHP-FPM logs (/var/log/plesk-phpXX-fpm/error_log) get huge size and are not rotated so the server might run out of space
Cause
Product issue:
- #PPPM-11362 "Plesk now daily rotates PHP-FPM error logs to prevent them from consuming all the server disk space and eventually causing issues on the server."
Fixed in:- Plesk Obsidian 08 June 2021 (Linux)
Note: Currently, /var/log/plesk-phpXX-fpm/error_log is shared and all domains write errors to it. As a result it is not included into any domain disk space statistics
As well as currently Plesk configured to rotate this log file on daily basis.
Resolution
Please consider updating your server:
Workaround
As a workaround, an additional log rotation by size for a PHP-FPM error log can be configured using native OS utilities, for example, the logrotate.
For more details refer to the logrotate documentation: https://linux.die.net/man/8/logrotate
The logrotate configuration file for PHP-FPM services is located in /etc/logrotate.d/ directory:
# ls -l /etc/logrotate.d/*php*
-rw-r--r-- 1 root root 203 Nov 15 23:36 /etc/logrotate.d/php-fpm
-rw-r--r-- 1 root root 211 Jan 9 13:25 /etc/logrotate.d/plesk-php56
-rw-r--r-- 1 root root 211 Jan 9 12:46 /etc/logrotate.d/plesk-php70
-rw-r--r-- 1 root root 211 Jan 9 11:11 /etc/logrotate.d/plesk-php71
-rw-r--r-- 1 root root 211 Jan 9 14:50 /etc/logrotate.d/plesk-php72
-
Connect to the server via SSH
-
Modify the corresponding file for required php-fpm service in an appropriate way
For example, for the system PHP-FPM/etc/logrotate.d/php-fpm, file will look like the following:CONFIG_TEXT: /var/log/php-fpm/*log {
rotate 14
daily
missingok
notifempty
size 100M
compress
missingok
notifempty
sharedscripts
delaycompress
postrotate
/bin/kill -SIGUSR1cat /run/php-fpm/php-fpm.pid 2>/dev/null2>/dev/null || true
endscript
}Note: parameters rotate (specified in days), size and daily (or monthly, weekly) can be changed to meet the requirements.
If it is required to rotate log files more often, then remove parameter daily from the config above and create a cron task.
For example, the following will run logrotate every 5 hours:# crontab -e
01 01,06,11,16,21 * * * /usr/sbin/logrotate /etc/logrotate.d/php-fpm -s /var/lib/logrotate/logrotate.status
Comments
4 comments
Of course, it would be a good idea to have a look at what exactly produces so many log entries, and fix the cause and not just the symptom.
Today a customer caused to cash my server generating 80 GB log files within a very short time. The entire disk was full and as you may noticed, nothing worked after that for several hours...
Please restrict log files in the next versions, because a single user can take down a plesk server, spaming log files until the disk is full.
Very useless that plesk checks it once per day... If the disk is full after 1 hour, plesk doesn't even work anymore and the full server is down.
Hello Maximilian,
I would like to say that this period is linked to the fact the rotation is performed during the daily task, alongside many other operations.
However, the rotation might be adjusted to execute this specific operation more frequently, as described in the "Workaround" section.
I got it thanks. In general this could be a serious exploit for plesk. When you create a php while loop which produces errors the whole time, your log files will continue to take down the server within minutes by filling up the disc space to maximum. A bad attacker (customer) could easily exploit this. I know it's not common, but you never know. ;)
Please sign in to leave a comment.