Access denied when trying to use PHP unix sock

[patrick-vlt]

I'm trying to use the docker image hipages/php-fpm_exporter with docker-compose.

Which user runs the php-fpm exporter process? I keep seeing this error:

2023-08-25 21:56:59 time="2023-08-25T19:56:59Z" level=error msg="Pool[unix:///socket/fpm/unix.sock]: Access denied.\n"

The permissions for this sock are set to:

/fpm/unix.sock
srw-rw----    1 2002     web              0 Aug 25 19:28 /socket/fpm/unix.sock

I added the root user to the web group, but this didn't solve the problem.

[mtwango]

Do you have rights set up on pool?

listen.mode = 0660 (default). I'm using 0666, since I need to flush opcache with library via pipeline and read it, but you should be ok with 0664

[muuvmuuv]

Having the same error, but on a Ubuntu 20 machine:

ll /run/php/php8.1-fpm.sock

srw-rw---- 1 www-data www-data 0 Oct 10 13:49 /run/php/php8.1-fpm.sock

sudo -u www-data ./php-fpm-exporter server --phpfpm.scrape-uri=unix:/run/php/php8.1-fpm.sock

INFO[0000] Starting server on :9253 with path /metrics  
ERRO[0003] Pool[unix:/run/php/php8.1-fpm.sock]: Access denied. 
ERRO[0003] invalid character 'A' looking for beginning of value 
ERRO[0003] invalid character 'A' looking for beginning of value 
ERRO[0003] Error scraping PHP-FPM: invalid character 'A' looking for beginning of value 

but curl seems to respond with a valid result:

curl -L 127.0.0.1:9253/metrics

go_memstats_heap_inuse_bytes 2.760704e+06
# HELP go_memstats_heap_objects Number of allocated objects.
# TYPE go_memstats_heap_objects gauge
go_memstats_heap_objects 14270
# HELP go_memstats_heap_released_bytes Number of heap bytes released to OS.
# TYPE go_memstats_heap_released_bytes gauge
go_memstats_heap_released_bytes 974848

[fbartels]

You're missing the path and therefore you're getting the access denied error and incomplete data.

It needs to be like this sudo -u www-data ./php-fpm-exporter server --phpfpm.scrape-uri='unix:/run/php/php8.1-fpm.sock;/status'

[fukawi2]

I'm getting the same on Ubuntu 24.04 with PHP 8.3:

$ sudo php-fpm_exporter get --log.level=debug --phpfpm.scrape-uri='unix:///run/php/php8.3-fpm.sock'
DEBU[0000] Pool[unix:///run/php/php8.3-fpm.sock]: Access denied.
ERRO[0000] Pool[unix:///run/php/php8.3-fpm.sock]: Access denied.
ERRO[0000] invalid character 'A' looking for beginning of value
ERRO[0000] invalid character 'A' looking for beginning of value
DEBU[0000] Updated 1 pool(s) in 603.693µs
Address:                unix:///run/php/php8.3-fpm.sock
Pool:
Start time:             Mon, 01 Jan 0001 00:00:00 +0000
Start since:            0
Accepted connections:   0
Listen Queue:           0
Max Listen Queue:       0
Listen Queue Length:    0
Idle Processes:         0
Active Processes:       0
Total Processes:        0
Max active processes:   0
Max children reached:   0
Slow requests:          0

Trying the command above suggested by @fbartels gives file not found error instead:

$ sudo php-fpm_exporter get --log.level=debug --phpfpm.scrape-uri='unix:/run/php/php8.3-fpm.sock;/status'
DEBU[0000] Pool[unix:/run/php/php8.3-fpm.sock;/status]: File not found.
ERRO[0000] Pool[unix:/run/php/php8.3-fpm.sock;/status]: File not found.
ERRO[0000] invalid character 'F' looking for beginning of value
ERRO[0000] invalid character 'F' looking for beginning of value
DEBU[0000] Updated 1 pool(s) in 540.386µs
Address:                unix:/run/php/php8.3-fpm.sock;/status
Pool:
Start time:             Mon, 01 Jan 0001 00:00:00 +0000
Start since:            0
Accepted connections:   0
Listen Queue:           0
Max Listen Queue:       0
Listen Queue Length:    0
Idle Processes:         0
Active Processes:       0
Total Processes:        0
Max active processes:   0
Max children reached:   0
Slow requests:          0

The socket exists, and I'm sudo'ing to root (for testing) so permissions on the socket shouldn't be an issue:

$ ls -lh /run/php/php8.3-fpm.sock
srw-rw---- 1 www-data www-data 0 Sep 10 06:43 /run/php/php8.3-fpm.sock

[jessebye]

For anyone else that might have had this problem, I discovered that "Access denied" and "File not found" errors didn't actually indicate a problem with the socket permissions or path. Instead I had specified /status at the end of the URI while the www.conf had pm.status_path = /fpm-status. I updated my URI to unix:///var/run/php-fpm/php-fpm.sock;/fpm-status and it started working correctly!

[sssuhanov]

You're missing the path and therefore you're getting the access denied error and incomplete data.

It needs to be like this sudo -u www-data ./php-fpm-exporter server --phpfpm.scrape-uri='unix:/run/php/php8.1-fpm.sock;/status'

Found a solution

For me, the problem was in parameter --phpfpm.scrape-uri

Working variation --phpfpm.scrape-uri='unix:///fake_address/php-fpm.sock;/fpm-status'

$ php-fpm_exporter get --phpfpm.scrape-uri='unix:///fake_address/php-fpm.sock;/fpm-status'
Address:                unix:///fake_address/php-fpm.sock
Pool:                   fake_name
Start time:             Mon, 16 Dec 2024 17:19:59 -0800
Start since:            73208
Accepted connections:   88676
Listen Queue:           0
Max Listen Queue:       0
Listen Queue Length:    0
Idle Processes:         30
Active Processes:       1
Total Processes:        31
Max active processes:   65
Max children reached:   3
Slow requests:          0

Error variation --phpfpm.scrape-uri unix:///fake_address/php-fpm.sock;/fpm-status

$ php-fpm_exporter get --phpfpm.scrape-uri unix:///fake_address/php-fpm.sock;/fpm-status
ERRO[0000] Pool[unix:///fake_address/php-fpm.sock]: Access denied.
ERRO[0000] invalid character 'A' looking for beginning of value
ERRO[0000] invalid character 'A' looking for beginning of value
Address:                unix:///fake_address/php-fpm.sock
Pool:
Start time:             Mon, 01 Jan 0001 00:00:00 +0000
Start since:            0
Accepted connections:   0
Listen Queue:           0
Max Listen Queue:       0
Listen Queue Length:    0
Idle Processes:         0
Active Processes:       0
Total Processes:        0
Max active processes:   0
Max children reached:   0
Slow requests:          0