System information: what the site runs on and what needs attention #

This guide explains the administration page Setup > System information (/setup/info) and the command ./console exp:system:info: which server answered, how it runs PHP, the health checks and what to do about each, the overview cards, the detailed parts below them, the report for a support request, and what is never shown.

It is written for administrators and for whoever supports a site. Every check, field and path below was checked against the code (kernel/classes/expsystemreport.php, kernel/classes/expsystemreportmask.php, kernel/private/classes/views/setup/info.php, kernel/private/classes/commands/systeminfo.php). The figures quoted are from the demonstration server on 6 October 2026, read-only.

Guides · Related guides: Deploying, Operating a site, Cronjobs, Security and audit

In short #

• Setup > System information needs the setup/system_info policy. It reads; it changes nothing. (The buttons of the HTTP cache, the query cache and the SQL profile, folded further down, post to it and need setup/managecache.)
• The page first says which server answered: Apache with PHP-FPM (and its pool), Exponential Velocity (with its worker model and release), FrankenPHP, PHP's built-in server. Each has its own PHP, OPcache and settings, so the same page shows different figures on https://example.org/admin and on Velocity's port. Open it on both.
• Health checks come first, failures and warnings before notes, each with what to do. The checks in order are folded under "N checks in order".
• Overview cards: Exponential, Server, PHP, OPcache and APCu, Database, Storage, Caches, Cronjobs, Mail, Locale and time, Machine.
• Download report (.txt), Download as JSON and Copy report as text give the same report for a support request. Passwords, keys, tokens, session ids, credentials in addresses and full server paths are never in it.
• Measure sizes (/setup/info/sizes) adds the size of var/, of each cache directory and of a database on a server. Measuring reads every file of var/ once (the cache directories are counted in the same walk), within ten seconds; the result is kept for ten minutes in var/<site>/cache/exp/system-report-sizes-<key>.json and shared by Apache's PHP-FPM and Velocity, so the page says when it was measured. Measure again measures anew.
• ./console exp:system:info [--json] [--sizes] --allow-root-user prints the report of the command-line PHP and exits 1 when a check fails.

1. Opening the page #

Setup > System information, or /setup/info in the administration siteaccess. The left menu of Setup lists it.

All five need setup/system_info. Give it only to administrators: even masked, the page says a lot about the installation.

2. Which server answered #

The blue banner (orange under Velocity) names the server that answered this request and how it runs PHP:

The badge on the right repeats the PHP version and SAPI (fpm-fcgi, cli, frankenphp, cli-server).

On the demonstration server on 6 October 2026, Apache answered with PHP 8.5.11 fpm-fcgi, memory_limit 4999M, OPcache on with its statistics hidden; Velocity answered with PHP 8.5.11 cli, memory_limit 4828M, OPcache on with a hit rate, and opcache.file_update_protection 0.

3. Health checks #

Each check has a state: Failure (red), Warning (amber), Note (blue) or OK (green), a title, and for the first three what it means and what to do (after the arrow).

The cronjob check reads the newest of: the run history of Setup > Cronjobs (var/<site>/cronjobs/history.json, read as it is) and the modification time of a non-empty var/log/cronjob*.log.

4. The overview cards #

A card with a failure or a warning among its checks has a red or amber edge and badge.

OPcache "statistics not available". Plesk can put opcache_get_status in disable_functions for a domain (on the demonstration server it is set in the pool configuration). The cache works; only its figures cannot be read from PHP. The page used to say "not installed" there. Velocity reads them because its PHP has no such setting.

5. The detailed parts #

Folded below the cards, each opens with a click:

• Active extensions, in load order, with the version their extension.xml, ezinfo.php or composer.json states (authors, licenses and websites are on ezinfo/about).
• PHP extensions and settings: every loaded extension, file_uploads, open_basedir (set or not), max_file_uploads, display_errors, the disable_functions list, the autoload functions, and the link to phpinfo().
• Site addresses: the public site, the address this page was served from, the SiteURL setting.
• Siteaccesses (#552): every siteaccess of site.ini [SiteAccessSettings] AvailableSiteAccessList and RelatedSiteAccessList, and how a request reaches each one. See section 5a.
• OPcache and APCu: memory, scripts, hit rate and interned strings as bars, and their settings.
• Velocity (under Velocity only): engine and role, address, process, console log, the views the server answers itself and who may open them, other engines running.
• Phar App Engine (under Velocity's own server): whether the engine runs from the archive and whether it is current.
• HTTP cache, Database queries (query cache and SQL profile) and Response cache, with their buttons for users with setup/managecache: purge all pages, remove dead entries and reset the counters of the HTTP cache; clear the query cache and reset its counters; switch the SQL profile on and off. These are the only things on the page that post, and each post carries the form token. Setup > Caches (/setup/cache) has the same buttons in its block "HTTP cache, query cache and SQL profile": both pages post the same fields (HttpCacheAction, QueryCacheAction, SQLProfileAction) to the same code, expCacheManager::sharedActionFromPost(), which checks setup/managecache itself. A post without the form token is refused (403).
• Database connection: type, server, socket, database name, character set, read replica.
• Report for support: the text of the report in a read-only field.

5a. Siteaccesses #

Which siteaccesses an installation has, and which one a request gets, used to be visible only in the INI files. The part Siteaccesses of the page shows it, folded (a native <details>: Enter or Space opens it).

• This request: the siteaccess this page got and the rule that chose it (a host map entry, a URI element, the default siteaccess ...), the default siteaccess ([SiteSettings] DefaultAccess) and MatchOrder. A StaticMatch is shown too: it gives every request one siteaccess and the rules are not used.
• Resolution map: the rules in MatchOrder order, each with the entries that name a siteaccess: the URI element (URIMatchType=element, one entry per available siteaccess) or the URI map (URIMatchMapItems), the host map (HostMatchMapItems, with the match method when it is not strict), the host and URI map (HostUriMatchMapItems), the ports ([PortAccessSettings]), the server variable and the index file; for the text and regexp types the pattern. The rule and the entry that chose this request are marked; the last row is the default siteaccess, used when no rule matches. The rules are tried from the top and the first match decides.
• All siteaccesses: one card each with its kind, design (SiteDesign and AdditionalSiteDesignList), locale and site languages, access extensions, whether hidden nodes are shown, whether a login is required, and the entries that reach it. Tags mark the default, the siteaccess of this page, one that is only in RelatedSiteAccessList (it can be read but not opened), and one that no rule reaches.
• Open opens the siteaccess where a visitor would find it, worked out by the code of the admin's "Open the site" link (ezpSiteAccessURL::root()): its host when the host map gives it one, its URI prefix when it is matched by URI, and the port of this page (an admin opened on Velocity's :8080 opens the sites on :8080). site.ini settings opens settings/view/<siteaccess>/site.ini.

The kind is admin, editor, login (a site that needs a login) or site, worked out from the designs and RequireUserLogin. A siteaccess can name its own with the optional setting site.ini [SiteAccessSettings] SiteAccessType (for instance SiteAccessType=shop); it is not set by default.

How it is read. The matching rules come from site.ini without siteaccess overrides, as eZSiteAccess::match() reads them, never from the request. The settings of each siteaccess come from eZSiteAccess::getIni(), which loads them into a separate eZINI and leaves the current siteaccess as it is. No database setting, password or key is read. The page needs setup/system_info, like the rest of Setup > System information. The class is expSiteAccessOverview (kernel/classes/expsiteaccessoverview.php); build() is pure and tested without a database in tests/tests/kernel/classes/expSiteAccessOverviewTest.php.

Translations. The texts are in design/admin/setup/info, translated to eng-US and ger-DE. The five machine-assisted administration languages (esl-ES, esl-MX, heb-IL, lat-VA, tlh-QO, #547) take them in their next pass: the master catalogue has them as unfinished messages, so the gap extraction of that pass finds them.

6. The report for a support request #

Download report (.txt) gives a text file like this (shortened):

Exponential system information
==============================
Generated: 2026-10-06T04:31:14-07:00
Answered by: Exponential Velocity (persistent workers: one process answers many requests ...)
Health: 9 ok, 0 warnings, 0 failures, 1 notes

[Server]
  Answered by              Exponential Velocity v0.0.4.42+da360b4-dirty
  Web server               QbixServer/1.5.0
  Workers                  148 configured, 12 spare
  Port                     8080 (HTTPS)

[Database]
  Engine                   sqlite 3.34.1
  File                     var/storage/sqlite3/sqlite.db
  Tables                   136
  Size                     389 MB
...

Download as JSON adds every fact the cards are made from (facts) and how many milliseconds each part took to read (facts.ms; about 10 ms in all on the demonstration server). Copy report as text copies the same text to the clipboard; it is shown only with JavaScript, and selects the text for copying by hand where the clipboard is not available.

7. What is never shown #

What is a secret is decided by one rule, expSecretRule, shared by exp:ini and expIniEditor, the audit log, the settings pages (expSettingsSecretRule) and this page (expSystemReportMask), so none of them shows what another hides. Each keeps its own mask text and may add names, never remove them. Tests: expSecretRuleTest, expSystemReportMaskTest, expSettingsPageTest.

• a value whose name is a secret (it contains password, passwd, passphrase, secret, token, salt, credential, privatekey or apikey, ends in pwd or dsn, is "key" or ends in Key, _key or -key; SortKey, KeyField and the like are not) shows only "(set, hidden)" or "(not set)"; the report adds a session id, a cookie, an Authorization and a Signature value; the database user is always hidden;
• the password inside an address is cut: mysql://user:pw@db/site becomes mysql://user:***@db/site;
• password=..., token: ... and the like in free text lose their value;
• a run of 26 or more letters and digits with a digit in it (a session id, a token, a key) becomes ***;
• paths inside the installation are relative to it (var/site/cache), paths under a web or home directory outside it keep only their last two parts (…/other/site); system paths such as /etc/vc/vc.conf stay.

/setup/info/php calls phpinfo() without its variables and environment parts, which carry the HTTP sign-in, the session cookie and whatever a server puts in the environment. Under Velocity it is plain text, as PHP's command-line SAPI writes it.

8. From the command line #

./console exp:system:info --allow-root-user            the text report
./console exp:system:info --json --allow-root-user     JSON
./console exp:system:info --sizes --allow-root-user    with directory and database sizes

bin/php/systeminfo.php is the same command. It reports the command-line PHP, which is neither PHP-FPM nor Velocity: OPcache is usually off there and is not a warning, and max_execution_time is "no limit". It exits 1 when a check fails, so it can guard a deploy script.

9. Site data #

Setup > Site data (setup/sitedata) lists the rows of the table ezsite_data: name and value pairs that the installation and its extensions keep in the database, such as ezpublish-version (the version of the installed database schema) and ezpublish-release. The list is read only, sorted by name, 50 rows a page, with a filter that takes a whole name or * for any characters (ezpublish-*). A column says whether templates may read the row (see Templates and design, "Site data in templates"). It needs the same policy as this page, setup/system_info, and is in the Setup menu for those who hold it. The list and the template fetch were brought over from LoveStack (mugoweb/ezpublish-legacy, commits 55029bd473, a679a13176, 94b7b6c239), with thanks to Mugo Web.

10. Usual questions #

The figures differ between Apache and Velocity. They should: two servers, two PHP processes, two OPcaches. Check the banner before comparing.

The OPcache hit rate under Velocity is low. A worker that started minutes ago has compiled every file once; the rate rises as it serves. The check ignores it under Velocity.

Sizes say "measured on request". Open Measure sizes. A size marked "≥" was cut short by the ten-second budget. Sizes look old. They are kept for ten minutes, whichever server measured them; Measure again measures anew.

The cronjob check warns though cron runs. Cron runs that write neither to var/log/cronjob*.log nor through Setup > Cronjobs are not seen. Send their output to var/log/cronjob-<part>.log.

Related pages #

• Database support: what the Database card's engine and version mean, the supported databases in their official order (SQLite 3, PostgreSQL, MongoDB, MariaDB, Oracle, MySQL) and the versions each needs.
• Operating system support: the operating systems, processors, web servers and PHP SAPIs the Server and PHP cards may show, sorted into tiers.