Errors resulting in crash

  • Today this kind of errors started to appear in the error log and after a while the site crashed. I had to recover it from backup. I can’t tell if it was infected or something else has gone wrong. In the crached sites, all the slugs were rewritten with slashes (in the db) so instead of wordfence it would be w/o/r/d/f/e/n/c/e
    A remote scan done with wordfence centrall showed no porblems at the time.
    I made a tarball fo the crashed site and database.
    After recovery from backup everything seems normal but I am affraid it will start again.

    PHP Warning:  preg_replace_callback(): Requires argument 2, 'wordfence::replaceVersionCallbacj', to be a valid callback in /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wordfenceClass.php on line 6281PHP message: PHP Warning:  preg_replace_callback(): Requires argument 2, 'wordfence::replaceVersionCallbacj', to be a valid callback in /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wordfenceClass.php on line 6281PHP message: PHP Warning:  preg_replace_callback(): Requires argument 2, 'wordfence::replaceVersionCallbacj', to be a valid callback in /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wordfenceClass.php on line 6281PHP message: PHP Warning:  preg_replace_callback(): Requires argument 2, 'wordfence::replaceVersionCallbacj', to be a valid callback in /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wordfenceClass.php on line 6281PHP message: PHP Fatal error:  Uncaught Error: Call to a member function insert() on null in /var/wwwxxx/htdocs/wp-content/plugins/wordfence/lib/wfDB.php:235
Stack trace:
#0 /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wfDB.php(225): wfModel->insert()
#1 /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wfLog.php(1363): wfModel->save()
#2 /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wfLog.php(283): wfRequestModel->save()
#3 /var/www/xxx/htdocs/wp-content/plugins/wordfence/lib/wordfenceClass.php(1307): wfLog->logHit()
#4 /var/www/xxx/htdocs/wp-includes/class-wp-hook.php(286): wordfence::wpRedirectStatusFilter(301, 'https://xxx...')
#5 /var/w

    Any ideas?

    • This topic was modified 5 years, 12 months ago by gresakg.
Viewing 2 replies - 1 through 2 (of 2 total)

  • Hi @gresakg,

    The error mentioned this string 'wordfence::replaceVersionCallbacj'

    What I suspect happened, is that someone was editing this file on your server, accidentally hit backspace, and then typed a j instead of a k.

    When you say the slugs were rewritten, what table was that in? For example, wp_wflogs.

    Dave

    Thread Starter gresakg

    (@gresakg)

    Hi @wfdave, thanks for your answer.
    Something very strange must have happened. I run the “corrupted” and the backed-up filesistem through Meld (diff viewer) and there were no difference except for the files in the wflogs directory, namely the files config-livewaf.php, config-livesync.php and config-transient.php
    I am the only (unix) user allowed to write to the filesystem and I was not touching it, I never do. The wflogs and uploads folders are the only exceptions where www-data is allowed to write.

    The problem was obviously in the database or the cache (I use nginx fastcache) or object cache (?) I am using php 7.3

    Regarding the database, this is an example: in wp_options the option name _transient_plugin_slugs has the following value

    a:19:{i:0;s:36:"a/k/i/s/m/e/t//a/k/i/s/m/e/t/./p/h/p";i:1;s:32:"c/a/s/t/e/o//c/a/s/t/e/o/./p/h/p";i:2;s:64:"c/l/a/s/s/i/c/-/e/d/i/t/o/r//c/l/a/s/s/i/c/-/e/d/i/t/o/r/./p/h/p";i:3;s:48:"c/l/o/u/d/f/l/a/r/e//c/l/o/u/d/f/l/a/r/e/./p/h/p";i:4;s:70:"c/o/n/t/a/c/t/-/f/o/r/m/-/7//w/p/-/c/o/n/t/a/c/t/-/f/o/r/m/-/7/./p/h/p";i:5;s:114:"c/o/n/t/a/c/t/-/f/o/r/m/-/7/-/t/o/-/d/a/t/a/b/a/s/e/-/e/x/t/e/n/s/i/o/n//c/o/n/t/a/c/t/-/f/o/r/m/-/7/-/d/b/./p/h/p";i:6;s:24:"g/g/g/a//g/g/g/a/./p/h/p";i:7;s:76:"u/k/-/c/o/o/k/i/e/-/c/o/n/s/e/n/t//u/k/-/c/o/o/k/i/e/-/c/o/n/s/e/n/t/./p/h/p";i:8;s:64:"w/o/o/-/p/o/l/y/-/i/n/t/e/g/r/a/t/i/o/n//_/_/i/n/i/t/_/_/./p/h/p";i:9;s:44:"l/o/c/o/-/t/r/a/n/s/l/a/t/e//l/o/c/o/./p/h/p";i:10;s:56:"n/g/i/n/x/-/h/e/l/p/e/r//n/g/i/n/x/-/h/e/l/p/e/r/./p/h/p";i:11;s:40:"p/o/l/y/l/a/n/g//p/o/l/y/l/a/n/g/./p/h/p";i:12;s:52:"r/e/d/i/s/-/c/a/c/h/e//r/e/d/i/s/-/c/a/c/h/e/./p/h/p";i:13;s:38:"s/s/s/w/p//s/s/s/l/i/d/e/r/w/p/./p/h/p";i:14;s:52:"w/o/o/c/o/m/m/e/r/c/e//w/o/o/c/o/m/m/e/r/c/e/./p/h/p";i:15;s:144:"w/o/o/c/o/m/m/e/r/c/e/-/a/d/v/a/n/c/e/d/-/f/r/e/e/-/s/h/i/p/p/i/n/g//w/o/o/c/o/m/m/e/r/c/e/-/a/d/v/a/n/c/e/d/-/f/r/e/e/-/s/h/i/p/p/i/n/g/./p/h/p";i:16;s:96:"w/o/o/c/o/m/m/e/r/c/e/_/p/a/y/u/n/i/t/y/c/w//w/o/o/c/o/m/m/e/r/c/e/_/p/a/y/u/n/i/t/y/c/w/./p/h/p";i:17;s:44:"w/o/r/d/f/e/n/c/e//w/o/r/d/f/e/n/c/e/./p/h/p";i:18;s:46:"w/o/r/d/p/r/e/s/s/-/s/e/o//w/p/-/s/e/o/./p/h/p";}

    This could be the root of the problem, but how could this have happened?

    Thank you for your assistance and best regards, Gregor

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Errors resulting in crash’ is closed to new replies.