Scan terminates with error

Hi @abigailm,

Could you please provide us with additional information by following these steps?

Thanks.

Sure. Here’s what the last lines of the activity log shows with debug mode on:

[Jun 20 17:11:16:1498003876.689335:4:info] Scan process ended after forking.
[Jun 20 17:11:16:1498003876.658167:10:info] SUM_KILLED:Previous scan terminated with an error. See below.
[Jun 20 17:11:16:1498003876.657860:2:error] Scan terminated with error: Unable to query database
[Jun 20 17:11:16:1498003876.504768:4:info] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.8&s=https%3A%2F%2Fwww.OMITTED.org&k=59311af5a7d2d49979fe7e309df8015cf5ce27e50841e5554fea87e3d1c04d5c2c40aa8d4ce7c5e57f2df7f389106bb0e62286ce0195b70d9f1372920baec36a7b9a122a669e6cf53a62f4eba5aa6617&openssl=268439647&phpv=7.1.6&betaFeed=0&cacheType=disabled&action=record_scan_metrics
[Jun 20 17:11:16:1498003876.503582:2:info] Done file contents scan
[Jun 20 17:11:16:1498003876.502088:4:info] Using MySQLi directly.
[Jun 20 17:11:16:1498003876.501814:4:info] Gathering host keys.
[Jun 20 17:11:16:1498003876.501506:2:info] Asking Wordfence to check URLs against malware list.
[Jun 20 17:11:16:1498003876.501077:2:info] Scanned contents of 161 additional files at 9.53 per second
[Jun 20 17:11:16:1498003876.500575:4:info] No files remaining for malware scan.

I am not seeing any errors being logged by wordpress.

The site’s apache logs shows some Mod Security errors — they look like this:

[Tue Jun 20 17:11:37.501714 2017] [:error] ModSecurity: collections_remove_stale: Failed to access DBM file "/tmp/global": Permission denied [hostname "_____"] [uri "/cgi-sys/ea-php71/wp/index.php"] 
[Tue Jun 20 17:11:37.501770 2017] [:error] ModSecurity: collections_remove_stale: Failed to access DBM file "/tmp/ip": Permission denied [hostname "____"] [uri "/cgi-sys/ea-php71/wp/index.php"] 
[Tue Jun 20 17:11:37.501812 2017] [:error] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname "_____"] [uri "/cgi-sys/ea-php71/wp/index.php"] 
[Tue Jun 20 17:11:37.502106 2017] [:error] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname "_____"] [uri "/cgi-sys/ea-php71/wp/index.php"] 

I have now resolved this problem on my own and am going to detail what I did to solve it in case anyone else has similar problems.

1) I did find a different error_log that I had overlooked, in the wp-admin subdirectory (which had grown to about 12 megs). This had entries like:

WordPress database error Table 'username_wp123.wp_wfHoover' doesn't exist for query SHOW FULL COLUMNS FROMwp_wfHoovermade by do_action('wp_ajax_nopriv_wordfence_doScan'), WP_Hook->do_action, WP_Hook->apply_filters, wordfence::ajax_doScan_callback, wfScan::wfScanMain, wfScanEngine->go, wfScanEngine->doScan, wfScanEngine->scan_fileContents_main, wordfenceScanner->scan, wordfenceURLHoover->hoover, wordfenceURLHoover->writeHosts, wfDB->queryWrite

I decided to try a clean reinstall.

2) In Wordefence options, I exported my wordfence settings to created a token.

3) In Wordfence options, I checked the box to delete wordfence tables and data on deactivation.

4) I deactivated and deleted Wordfence.

5) I reinstalled Wordfence from the wordpress plugin repository.

6) I imported my previously set options using the token I had created.

7) I ran a scan — this time it was successful.

So I can only guess that somewhere along the line some entry had been corrupted and that Wordfence was not correctly identifying the database, and that with a clean install I forced Wordfence to recreate all tables and solved the problem.

From revising the wp-admin/error_log, it looks like this problem might have originated in February with an error: “The table ‘wp_wfFileMods’ is full for query insert” — which occurred right before the wfHoover doesn’t exist errors started appearing. So perhaps the problem originated when Wordfence was unable to write important data to to wfFileMods.

Hi @abigailm,

Thanks a lot for sharing your findings as well as the solution you’ve applied!

This will be helpful to other users.