linux - Multiple cgroup in service cron status: what does it mean?

I'm trying to diagnose some funky behaviour with cron on one of our Ubuntu 16.04 LTS server.

When I do service cron status I get this:

root@baobaospa:/etc/cron.d# service cron status
● cron.service - Regular background program processing daemon
   Loaded: loaded (/lib/systemd/system/cron.service; enabled; vendor preset: enabled)

   Active: active (running) since mar 2018-06-12 21:54:33 CEST; 12min ago
     Docs: man:cron(8)
 Main PID: 11789 (cron)
    Tasks: 6
   Memory: 4.2G
      CPU: 13min 59.438s
   CGroup: /system.slice/cron.service
           ├─ 8297 /usr/sbin/CRON -f
           ├─ 8302 /bin/sh -c php /var/www/web1/baobao/shop/cron.php
           ├─ 8304 php /var/www/web1/baobao/shop/cron.php

           ├─ 8348 /usr/bin/php /var/www/web1/baobao/shop/cron.php -mdefault
           └─11789 /usr/sbin/cron -f

This is the first time that I see those multiple entries under CGroup: what are thos supposed to mean? I'm worried because I see multiple entry running that cron.php via php-cli: does it mean that the file is being called multiple times?

I already tried to inspect under /etc/cron.d* but I only get one hit with cron.php and I've no crontab -l set for ANY users.

Answer

You’re seeing the members of the control group associated with the service: there are two cron processes (I have no idea why one of them is in uppercase), one /bin/sh spawned by cron, one /usr/bin/php process spawned by that shell, and the other php process is presumably spawned by the first one.

If a service routinely spawns other processes, or has several helper processes running alongside the main process all the time, then it’s normal to see more than one entry in the cgroup. For example, on my server, apache2, postfix@- and dovecot all have multiple processes. You can also see the full tree of control groups and processes with systemctl status or systemd-cgls.