PHP 5.5.11

Hi Matt,

Today, I will turn off “Scan file contents for backdoors, trojans and suspicious code”. I didn’t do it in the past 2 days because I had completely purge all the cron jobs from wordpress. So, scheduled scans were working properly.

This afternoon, I checked on my sites and all were down but after lunch they were up again. I have 3 installs of WF, 2 of them ran scans around 1 AM and completed successfully. But the main site ran around 4 AM and was stuck and then again around 8 to 9 AM another scheduled scan was posted but never started my guess because the 4 AM scan never finished.

So, I’m guessing this is an option maybe you guys can add in a future release. If a scheduled scan is stuck and another scheduled scan finds it in that state after a certain amount of time, 1 hour(?) more or less or let the user define the time. Then the new scheduled scan can kill the stuck scan.

Anyways, just an idea. I will post back later on to let you know the results. If you need any logs let me know. Oh, I took a couple with debug mode on several days ago if you are interested.

Thanks again!

Ok, thanks — I will send the idea on to the dev team, to see if the scans can be killed automatically when they are stuck for too long, or even if they can be safely restarted automatically. It could help in some cases like this, as long as it doesn’t repeatedly get stuck on the same stage.

If you can send the scan logs, I will take a look — the debugging details might help show anything else unusual, as long as the log isn’t too big to email. My address again is mattr (at) wordfence.com

Thanks!

Hey Matt,

I email you 2 logs yesterday. I hope you got them or did they bounce? They are pretty long and Microsoft marked a few with debug code as spam for me the other day.

I set WordFence with “Scan file contents for backdoors, trojans and suspicious code” unchecked but today I found these 3 scans that never completed:

[Aug 25 00:47:24:1440478044.813436:1:info] Scheduled Wordfence scan starting at Tuesday 25th of August 2015 12:47:24 AM
[Aug 24 23:50:16:1440474616.124198:2:info] Analyzed 400 files containing 6.74 MB of data so far
*
*
[Aug 24 23:50:10:1440474610.336182:1:info] Contacting Wordfence to initiate scan
[Aug 24 23:49:58:1440474598.630376:1:info] Scheduled Wordfence scan starting at Monday 24th of August 2015 11:49:58 PM
[Aug 24 14:34:03:1440441243.755670:2:error] Scan terminated with error: There was an error connecting to the the Wordfence scanning servers: couldn’t connect to host
[Aug 24 14:33:48:1440441228.638056:2:info] Analyzed 5225 files containing 289.66 MB of data.
*
*
*
[Aug 24 14:32:22:1440441142.455658:1:info] Scheduled Wordfence scan starting at Monday 24th of August 2015 02:32:22 PM

* Removed lines by me so it doesn’t look so bloated.

Thanks for your assistance!

Luis

I did receive the scan logs — I did not skim through the entire contents yet, but I see the message that there was an error reaching the Wordfence scanning servers too, now. Since this hasn’t happened in most of the past scans that you’ve sent, even when they didn’t complete successfully, it’s most likely a sign that the host was overloaded during that time, too. Either the network was so busy from other sites (or attacks on any hosted site), or the CPU was too busy to respond quickly enough, or memory was too full — sorry, but I think we might not be able to make Wordfence scans work reliably on this host because of those problems.

The feature request I’ve put in might help in a future version of Wordfence, if stuck scans can be killed or resumed automatically. For now, at least the firewall and other features should still continue working — if you can reduce the data (like backups) stored on the server, and disable any scans that you can live without, that might be the best you can do.

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it.

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it.

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it.

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it.

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it. (https://www.webhostingsecretrevealed.net/blog/hosting-updates-news/the-who-what-when-of-endurance-international-group-eig/ )

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Hey Matt,

Thanks for the reply. Yes, Arvixe is going through a terrible period of time since EIG bought it.

I’m happy my problem will be taken in consideration to include a feature into your plugin. I feel honored in a way. ??

I guess I can turn back that option to scan for backdoors, etc and leave the one that scans as images off since you mention it is very rare to happen.

Support offered me a server migration, I don’t thank that will solve my problem.

Thanks for all your help and support Matt!

Regards,

Luis

Ok, good luck with the site going forward! The server migration might help if they move you to a server with fewer users on it, if part of the problem is CPU/memory/network usage, so it’s worth a shot if they can move it without any new issues.

-Matt R