Diagnosing High CPU Usage in PHP Processes with strace

In earlier days knowing the strace command was impressive; today it is a common tool for diagnosing performance problems. When a high‑load server shows most CPU time spent in kernel mode ("sy"), strace becomes the appropriate utility to trace system calls.

The article presents a real case where the top output reveals several PHP processes consuming CPU, while memory and swap are not critical. Since the CPU usage appears in kernel space, the author suggests using strace to investigate.

Basic attachment: shell> strace -p <PID>

Because raw output can be overwhelming, the -c option aggregates time per syscall: shell> strace -cp <PID>

The aggregated result shows that the clone syscall dominates CPU time. To examine this call in detail, the following command is used: shell> strace -T -e clone -p <PID>

The -T flag reports the actual time each syscall takes, and -e clone filters for the clone operation. The output indicates that a single clone call can take several hundred milliseconds.

According to the manual, clone creates a new process. In PHP, such a system call often originates from the exec function. The article verifies this with: shell> strace -eclone php -r 'exec("ls");'

Thus, the high CPU usage is traced back to PHP code invoking exec , which triggers a costly clone system call. The article concludes with this practical debugging workflow for Linux operations.