I'm toying around with the idea of implementing something that profiles code on the production server and wanted some best-practice advice. Obviously it's a bad idea to profile ALL requests because of the added overhead so I was looking into some techniques that will randomly invoke the profiler per request. Something like 1 profile per every 10,000 requests.

I know there is a way to achieve such a task with Facebook's XHProf Profiler but was hoping for a similar solution using xdebug.

So my questions are (assuming xdebug is the profiler):

  1. Is this kind of feature even advisable? I'd like to get some real world data from the production environment but not if it means destroying the user experience due to overhead.
  2. Does installing xdebug on production open the server up to attackers/exploiters in any way (assuming the debugger is not enabled)? Is there a boiler-plate config for this type of setup?
  3. What's the best way to trigger the profiler for an appropriate sample size?

Any other insight into the matter would be much appreciated.

php profiling xdebug xhprof
Edit
Report