cfexecute fails, while execution from command line works

Akitogo Team, 25 Nov 2025

This is a quick technical note for a strange issue where our bug tracking system logged an increasing number of messages like Error invoking external process /usr/bin/identify. Curiously, executing the command directly from the CLI worked without any issue.

After some research and with the help of AI, we inspected the running process to see how the OS was viewing the Java executable:

sudo ls -la /proc/$(pgrep -f catalina | head -1)/exe

lrwxrwxrwx 1 lucee lucee 0 Nov 23 20:51
/proc/348297/exe -> '/usr/lib/jvm/java-21-openjdk-amd64/bin/java (deleted)'

So, what happened?

Our installation uses the system Java package. We recently updated system packages, which included a Java update (minor version bump), but we did not restart Lucee immediately. This led to the issue.

Why "(deleted)" causes external process failures

The (deleted) marker indicates that:

• The process is still running with the old Java binary loaded in memory (PID 348297).
• The original file on disk was removed or replaced during the package update.
• The kernel marks the link as "(deleted)" because the original inode no longer exists at that path.

The Technical Reason: When Lucee (Java) attempts to spawn a generic external process (like identify via ImageMagick), it relies on forking the existing Java process. On Linux, if the underlying executable of the parent process is replaced or deleted, the fork/exec operation can fail because the OS cannot correctly resolve the binary path for the new subprocess context.

How to fix

A simple Lucee restart will resolve the issue by loading the new Java binary into memory:

systemctl restart lucee_ctl

Permanent Fix: Automating the Restart

To prevent this from surprising you in production, you can add an APT hook. This script detects if the specific Java binary was modified during an update and automatically restarts Lucee.

Create the file /etc/apt/apt.conf.d/99restart-lucee-on-java-update:

DPkg::Post-Invoke {
    "if [ -n \"$(find /usr/lib/jvm/java-21-openjdk-amd64/bin/java -cmin -2 2>/dev/null)\" ]; then echo 'Java binary updated. Restarting Lucee...'; systemctl restart lucee_ctl; fi";
};

How this works: The find ... -cmin -2 command checks if the Java binary was modified (metadata change) within the last 2 minutes. This ensures Lucee only restarts when the Java binary is actually touched, rather than restarting on every single apt upgrade run.