Let's look at the results of a top high load on the server:
top
Tip: When you run top, click "
1" Open CPU list, press "shift+p" to sort CPU.
In this case, we can easily find the main CPU is occupied by a number of PHP processes, while PHP process takes more memory, but still the balance of system memory, SWAP is not serious, that is not the main reason.
However, the list can be seen in the CPU CPU is mainly consumed in kernel mode "sy", rather than the user mode "us", and our experience does not match. Linux operating system has a lot of tools used to track the behavior of a program, a function call trace kernel mode with "strace" function calls the user mode tracking "ltrace", so here we should use "strace":
shell>strace-p <PID>
But if the direct use strace to track a process, then wait for your characters tend to be full screen roll, want to see the crux of the problem here is not an easy thing, but fortunately strace can be summarized by the time the operation:
shell>strace-cp<PID>
By " c" option used to summarize total time of each operation, probably the result of operation as shown below:
strace -cp
Obviously, we can see the main CPU clone operation is consumed, you can also track individual clone:
shell>strace-T -e clone-p <PID>
The actual operating time can get consumed by "T" option, by "e" option to track an action:
strace -T -e clone -p
Obviously, a clone operation requires hundreds of milliseconds, as the meaning of the clone, refer to the man pages:
clone() creates a new process, in a manner similar to fork(2). It is actually a library function layered on top of the underlying clone() system call, hereinafter referred to as sys_clone. A description of sys_clone is given towards the end of this page.
Unlike fork(2), these calls allow the child process to share parts of its execution context with the calling process, such as the memory space, the table of file descriptors, and the table of signal handlers. (Note that on this manual page, “calling process” normally corresponds to “parent process”. But see the description of CLONE_PARENT below.)
简单来说，就是创建一个新进程。那么在 PHP 里什么时候会出现此类系统调用呢？查询业务代码看到了 exec 函数，通过如下命令验证它确实会导致 clone 系统调用：
shell>strace-eclone php -r 'exec("ls");'
最后再考大家一个题：如果我们用 strace 跟踪一个进程，输出结果很少，是不是说明进程很空闲？其实试试 ltrace，可能会发现别有洞天。记住有内核态和用户态之分。
Linux strace command Detailed http://www.linuxidc.com/Linux/2012-12/75671.htm
Linux strace tracking process information http://www.linuxidc.com/Linux/2012-10/72432.htm
Strace under Linux using command heavyweight introduction http://www.linuxidc.com/Linux/2012-10/71823.htm
Linux strace to solve the mistakes http://www.linuxidc.com/Linux/2011-08/41308.htm
Linux process control --strace: tracking signals and system calls http://www.linuxidc.com/Linux/2011-05/35823.htm
Process Analysis Tools Linux program execution --strace http://www.linuxidc.com/Linux/2013-11/93023.htm