Profiling one request in production, briefly

The slow request cannot be reproduced locally, and profiling everything in production is not an option.

xdebug.mode = profile
xdebug.start_with_request = trigger
xdebug.trigger_value = a-long-random-string

# then, from one machine, one request:
curl -H 'Cookie: XDEBUG_TRIGGER=a-long-random-string' 
     https://example.com/reports/monthly

# and the mode is off again within the hour.

The trigger value has to be a secret, or anybody can make the server write a profile per request and fill the disk — which is a denial of service with a two-word payload. Even with the trigger, the extension being loaded costs something on every request, so this is a deliberate short window with a calendar reminder to undo it, not a configuration to leave in place.