File Change email incorrectly says every file deleted

  • Resolved jrpstonecarver

    (@jrpstonecarver)


    10 months ago

    On January 27th I got one of the usual emails from Solid Security… one of those that announces file changes it has noted on our system. This one was special though, as it seemed to state that every file on our system had been deleted and not replaced. Specifically it says that 13,824 files were deleted.

    However, that is obviously not correct. Our system continues to function normally, both for users to the site and on the back end within wordpress.

    I don’t know what could have happened, but I think there was a recent update to Solid Security, and it might be the case that the update did something to mess up the tracking of file changes. I have automatic updates turned on for Solid Security and I seem to recall seeing a recent tracking email very much like this one that I interpreted as it being updated.

    We have version 9.3.0 installed at the moment.

    Again, this is not a problem with our system – everything works and is still present as far as I can tell – but that was a rather alarming email to find this morning. Perhaps someone wants to look into how this sort of message could accidentally be created?

    I’d include an image of the start of the email here, but I don’t have it hosted anywhere to insert via a URL. But here is the text extracted from the top:

    File Change Warning
    Files on your site have changed since the last scan. Please review the report below to verify the changes are expected.

    Scan Summary
    0 13824 0
    Added Removed Modified

    Removed Files
    File
    wp-admin/user/about.php

    Modified: April 30, 2020 9:46 pm File Hash: 219a4e201e9d829ad939e2336e446c02

    and it goes on from there for a very long time.

    Just thought someone should know.

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter jrpstonecarver

    (@jrpstonecarver)

    And a follow up on this. I just now got another email from solid security. This one informs me that 13,824 files have been added to our website:

    File Change Warning
    Files on your site have changed since the last scan. Please review the report below to verify the changes are expected.

    Scan Summary
    13824 0 0
    Added Removed Modified


    Added Files
    File
    wp-admin/user/about.php

    Modified: April 30, 2020 9:46 pm File Hash: 219a4e201e9d829ad939e2336e446c02

    As before, our site continues to run correctly and without issue. What happened to cause the file change monitoring tools to decide that every file had disappeared one day, and they all returned the next I have no idea, but it is clearly not something that we did or caused by any deliberate action.

    Our site is mostly static, with occasional changes. We don’t allow users to login or even leave comments. Whatever happened here was not of our doing.

    Odd.

    Plugin Support chandelierrr

    (@shanedelierrr)

    Hi @jrpstonecarver,

    It’s often hard to tell why the file change warning is triggered, but it’s not uncommon to get false flags. Your instincts are exactly right: if it’s saying that all of the files are gone, it’s a false flag. That can happen due to some process at the host essentially “confusing” the system and I would just ignore that.

    The File Change feature of Solid Backups is one of the more powerful features of Solid Backups, but also one of the more unpredictable ones. In order to scan the entire server environment for file changes, it’s also one of the more processor-intensive features and can have performance implications.

    We’d recommend only using it for short periods and in the case of issues that require acute monitoring, and to expect some inconsistency and treat reports with healthy skepticism.

    I hope this shed some light.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘File Change email incorrectly says every file deleted’ is closed to new replies.

Tags