一、现象
1.查看进程是否存在
ps -ef | grep -v 'grep' |grep -E 'shell/cron/bonus/cash'
www 2624 1 0 Oct24 ? 00:00:35 /usr/local/bin/php /data1/www/htdocs/hb.e.weibo.com/v2/www/htdocs/index.php --uri=shell/cron/bonus/cash --get=proc_num=1&proc_total=1 --post=
2.查看进程创建时间
ps -p 2624 -o lstart
STARTED
Sat Oct 24 22:20:03 2015
3.查看进程的系统调用
strace -p 2624
Process 2624 attached - interrupt to quit
restart_syscall(<... resuming interrupted call ...>) = 0
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 0) = 0 (Timeout)
poll([{fd=5, events=POLLIN|POLLPRI|POLLRDNORM|POLLRDBAND}], 1, 1000) = 0 (Timeout)
4.查看fd=5打开的文件
lsof -d 5 | grep 2624
php 2624 www 5u IPv4 3876970637 0t0 TCP 10.74.14.199:45473->host-31.alipay.com:https (ESTABLISHED)
二、复现
1. 侦听107.170.249.52的1234端口
2.访问107.170.249.52:1234
3.107.170.249.52接到该请求
4.strace该curl进程
5.与上文所述现象一致
三、解决
php curl调用时设置超时