Many apache2 processes spawned following file uploads, all using I/O and slowing host to crawl

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • traefik:3.6.10 Community Docker build
  • Is this the first time you’ve seen this error? (Yes / No):
    • No
  • When did this problem seem to first start?
    • Fairly long-standing issue, although it’s exacerbated by a recent workflow change (more below)
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

After uploading many files (specifically from a Signal app backup), some sort of processing operation begins running in the background. I can watch a process monitor as approximately 20 apache2 processes at a time will start up, consuming little in the way of system resources except for storage I/O and virtual RAM which has the side effect of bringing the entire system to a crawl. Any other services on the host will become unresponsive including Nextcloud, so at least there’s comfort in knowing that no other external sources are also consuming resources at this time.

To make troubleshooting that much more difficult, there’s little in the way of logged information either at the container level (which I believe outputs apache Access and Error logs) as well as Nextcloud’s own logging facilities, which only record slow response times for its own services.

Is there a better way to get insight into what exactly Nextcloud is doing, and ideally limit these background processes to only one or two at a time? Thanks in advance for any help!

Steps to replicate it (hint: details matter!):

  1. Upload many (small) files in a short window of time
  2. Observe as Nextcloud spins up multiple apache2 processes for some sort of background operation.

Log entries

Nextcloud

Willing to share full log if necessary (concerned about privacy), but the gist of it is Slow session start messages for most of the time, and a database error towards the end before I restarted the Nextcloud container.

Container

Please see below for the container logs. You can see the mobile app uploading the output of the Signal backup, until eventually output ceases for over an hour. At this point I’ve been watching the process information from a terminal, and decided to restart the container. After that point operation returns to normal.

Container log
127.0.0.1 - - [03/Jun/2026:19:58:19 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
127.0.0.1 - - [03/Jun/2026:19:58:20 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:07:41 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/55/ HTTP/1.1" 503 1017 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
[my mobile] - [my user] [03/Jun/2026:18:07:46 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/f4/ HTTP/1.1" 503 1017 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:07:02 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
127.0.0.1 - - [03/Jun/2026:20:07:01 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:04:45 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/ae/ HTTP/1.1" 207 2502 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
[my mobile] - [my user] [03/Jun/2026:18:05:01 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/26/ HTTP/1.1" 503 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:07:45 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:07:40 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/77/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
[my mobile] - [my user] [03/Jun/2026:18:07:45 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/signal-backup-2026-05-30-18-02-45/files HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:09:14 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
127.0.0.1 - - [03/Jun/2026:20:09:19 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:05:30 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/11/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:10:30 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:07:46 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/2a/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
[my mobile] - [my user] [03/Jun/2026:18:07:37 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/7a/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:10:47 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:07:41 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/signal-backup-2026-05-30-18-02-45/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"
127.0.0.1 - - [03/Jun/2026:20:10:54 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
127.0.0.1 - - [03/Jun/2026:20:11:02 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.67 (Debian) PHP/8.3.31 (internal dummy connection)"
[my mobile] - [my user] [03/Jun/2026:18:06:28 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/files/dc/ HTTP/1.1" 207 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/33.1.0"

[Nextcloud container restarted at approximately 20:15]

=> Configuring PHP session handler...
==> Using default PHP session handler
=> Searching for hook scripts (*.sh) to run, located in the folder "/docker-entrypoint-hooks.d/before-starting"
==> Skipped: the "before-starting" folder is empty (or does not exist)
[my desktop] - [my user] [03/Jun/2026:20:15:41 +0000] "GET /index.php/204 HTTP/1.1" 204 614 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:15:58 +0000] "GET /index.php/204 HTTP/1.1" 204 614 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:15:59 +0000] "GET /status.php HTTP/1.1" 200 810 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:15:59 +0000] "PROPFIND /remote.php/dav/files/[my user]/ HTTP/1.1" 207 959 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:04 +0000] "GET /ocs/v1.php/cloud/capabilities?format=json HTTP/1.1" 200 2743 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:05 +0000] "GET /ocs/v2.php/apps/files/api/v1/directEditing?format=json HTTP/1.1" 200 1069 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:05 +0000] "GET /ocs/v2.php/apps/terms_of_service/terms?format=json HTTP/1.1" 404 909 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:07 +0000] "GET /ocs/v1.php/cloud/user?format=json HTTP/1.1" 200 1246 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:10 +0000] "GET /remote.php/dav/avatars/[my user]/128.png HTTP/1.1" 200 2458 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:05 +0000] "GET /ocs/v2.php/apps/user_status/api/v1/user_status?format=json HTTP/1.1" 200 847 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:12 +0000] "GET /ocs/v2.php/core/navigation/apps?absolute=true&format=json HTTP/1.1" 304 658 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:12 +0000] "GET /ocs/v2.php/core/navigation/apps?absolute=true&format=json HTTP/1.1" 304 658 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - - [03/Jun/2026:20:16:08 +0000] "GET / HTTP/1.1" 302 1398 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0"
[my desktop] - [my user] [03/Jun/2026:20:16:12 +0000] "PROPFIND /remote.php/dav/files/[my user]/ HTTP/1.1" 207 4167 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - - [03/Jun/2026:20:16:09 +0000] "GET /index.php/apps/files/preview-service-worker.js HTTP/1.1" 200 6366 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0"
[my desktop] - [my user] [03/Jun/2026:20:16:17 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto HTTP/1.1" 207 2474 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:19 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups HTTP/1.1" 207 1428 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
[my desktop] - [my user] [03/Jun/2026:20:16:20 +0000] "PROPFIND /remote.php/dav/files/[my user]/Crypto/SignalBackups/signal-backup-2026-06-03-17-56-11-tmp HTTP/1.1" 404 898 "-" "Mozilla/5.0 (Windows) mirall/33.0.5 (build 20260519) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)"

Configuration

Nextcloud

occ config:list system output
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***Host on private subdomain directed by AdGuardHome container***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "***Host on private subdomain directed by AdGuardHome container***",
        "htaccess.RewriteBase": "\/",
        "dbtype": "pgsql",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "version": "32.0.9.2",
        "installed": true,
        "maintenance": false,
        "updater.release.channel": "stable",
        "maintenance_window_start": 7,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "upgrade.disable-web": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "loglevel": 1,
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "app_install_overwrite": [],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "redis", (On private docker network. redis output seems to confirm successful access)
            "port": "6379"
        }
    }
}

Apps

occ app:list output
Enabled:
  - activity: 5.0.0
  - admin_audit: 1.22.0
  - app_api: 32.0.0
  - calendar: 6.4.2
  - cloud_federation_api: 1.16.0
  - contacts: 8.3.11
  - contactsinteraction: 1.13.1
  - cookbook: 0.11.6
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.5
  - federatedfilesharing: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0
  - integration_google: 4.3.1
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0
  - notifications: 5.0.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0
  - photos: 5.0.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0
  - survey_client: 4.0.0
  - systemtags: 1.22.0
  - tasks: 0.17.1
  - text: 6.0.2
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - bruteforcesettings: 5.0.0 (installed 2.4.0)
  - circles: 32.0.0 (installed 24.0.0)
  - comments: 1.22.0 (installed 1.14.0)
  - encryption: 2.20.0
  - federation: 1.22.0 (installed 1.18.0)
  - files_external: 1.24.1
  - suspicious_login: 10.0.0
  - twofactor_nextcloud_notification: 6.0.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0
  - weather_status: 1.12.0 (installed 1.8.0)

Define “small” and the rough quantity of files.

None of the log entries indicate an actual upload transaction. Are these from the correct time window?