Scan process ended after forking

Hi @kiriska,

For both the problematic Wordfence instance and one that is working fine, could you please check the Wordfence System Info page:

• Go to the Wordfence Tools page
• Click the Diagnostics tab
• In the Other Tests section (near the bottom of the page), click the link that reads “Click to view your system’s configuration in a new window“. This will open the Wordfence System Info page.

And then compare both environments, in particular the following parameters:

• Server API
• Loaded Configuration File
• PHP Version
• cURL support
• cURL Information

Hi @wfyann,

The five values you listed are identical in the two configurations. Aside from differences in URL paths and cookies, the only significant difference seems to be auto_prepend_file, which is “no value” in problematic instance and “wordfence-waf.php” in working instance.

“wordfence-waf.php” exists on the problematic instance, in the correct location, but I’m not sure how/where to set this value? This was a fresh install of Wordfence, as well.

An update: auto_prepend_file is set when you configure settings for the Firewall on WF install. I had declined to do so for the problematic instance and there wasn’t an obvious way to do so after the initial post-install prompt. I reinstalled WF, configured the Firewall, so auto_prepend_file is properly set on the problematic instance.

However, the scan still fails to run and the same error appear in the log.

Now the only differences in the two server configuration docs are URL paths and cookies.

After hitting the “Scan process ended” error, a few other items appear in the log occasionally:

[Mar 31 13:30:27] Scan process ended after forking.
[Mar 31 13:30:49] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.7.3&s=http%3A%2F%2F%5BURL%5D&k=f701f3d5946c5878180b84431c0b3e0decf21ecd20cc682e267179687d4acf772a7a7407f6cc93ec92230a4a57dc5d308259e35ae382d25af8f60b84534c04bd3a9241ea3b75c52d65188bd0c4adf1aa&openssl=9469999&phpv=5.3.27&betaFeed=0&cacheType=disabled&action=ping_api_key
[Mar 31 13:31:14] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.7.3&s=http%3A%2F%2F%5BURL%5D&k=f701f3d5946c5878180b84431c0b3e0decf21ecd20cc682e267179687d4acf772a7a7407f6cc93ec92230a4a57dc5d308259e35ae382d25af8f60b84534c04bd3a9241ea3b75c52d65188bd0c4adf1aa&openssl=9469999&phpv=5.3.27&betaFeed=0&cacheType=disabled&action=password_load_results
[Mar 31 13:31:14] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.7.3&s=http%3A%2F%2F%5BURL%5D&k=f701f3d5946c5878180b84431c0b3e0decf21ecd20cc682e267179687d4acf772a7a7407f6cc93ec92230a4a57dc5d308259e35ae382d25af8f60b84534c04bd3a9241ea3b75c52d65188bd0c4adf1aa&openssl=9469999&phpv=5.3.27&betaFeed=0&cacheType=disabled&action=password_load_jobs

@kiriska,

Thanks for the update!

I’m wondering if you see any error/warning messages in the web server error logs (/var/log/httpd/error_log or /var/log/apache2/error.log) around the same time as the scan process ending (Mar 31 13:30:27)?

Also just to be sure we haven’t missed anything, could you, if that’s OK with you, paste here the values from the Wordfence System Info page for the following parameters (for both aforementioned instances):

• Loaded Configuration File
• PHP Version
• cURL support
• cURL Information

Nothing appears in the error log corresponding to the scan times. (The last error was from 24 March.)

Both the working and problematic instances of Wordfence show the following:

Loaded Configuration File: /home/username/public_html/php.ini
PHP Version: 5.3.27
cURL support: enabled
cURL information: 7.38.0

The full php.ini file can be viewed here: https://pastebin.com/QTbD7mVL

Update: Looks like whatever the problem is lies with the theme for the site. I swapped to a WordPress default theme and Wordfence ran fine.

I’m currently trying to figure out what in the theme would stop Wordfence from running properly. Clearly the problem isn’t WF’s fault, but any direction in this matter would be appreciated.

Last update: The problem theme was disabling the admin bar for non-admin users, which might have been interfering with permissions for WF. Removing that bit solved the problem, so hurray!

Thanks for your help.

Hi @kiriska,

Thanks a lot for posting this!

Your investigation provided very useful information.