Scan process ended after forking

same here welcome to the club :/ One of my sites I cannot get a scan to finish….

Hi,

@drepublik – I’ll look for your Diagnostic report.

@vinnymicke –

If they’re failing at some point, can you do the following so I can get the information I need to help you?

Kill the existing scan if it is still running (The “Start New Scan” button turns in to a “Stop” button while the scan is running)

Go to your Scan > Scan Options and Scheduling page and locate the “Performance Options”

Set “Maximum execution time for each scan stage” to 20 on the options page
Click to “Save Changes”

Go to the Tools > Diagnostics page

In the “Debugging Options” section check the circle “Enable debugging mode”

Click to “Save Changes”

Start a new scan

Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log and paste them here

Thanks,

Gerroald

Hi,

We haven’t heard back from you in a while, so I’ve gone ahead and marked this thread as resolved.

Please feel free to open another thread if you’re still having issues with Wordfence.

Thanks,

Gerroald

Hi Gerroald, you said you will look at the Diagnostic report. And what’s the result?

@drepublik

I see your max_execution_time is set to 300 on the server. Could you try lowering that to 30 or 60, please?

Also, please navigate to Wordfence > Tools > Diagnostics and at the bottom in Debugging Options, please enable the option Enable debugging mode.

Next, go to Wordfence > Scan > Scan Options and Scheduling and check to see if the bottom two options in General Options are disabled. It would be best to have those disabled for now (Scan files outside your WordPress installation, Scan images, binary, and other files as if they were executable)

Just below that, in the Performance Options, set the Maximum execution time for each scan stage to 20. (That is if your reset your max_execution_time from 300 to 30. If you set it from 300 to 60 for max_execution_time, then use 45 for this setting.)

You can then go back to the scan page and cancel any scan which may be running and start a new one. When it hangs up or fails, click the “View Full Log” there above the scan and copy over the top 20 lines or so and send them over here if you could.

We can maybe see what is causing the issue here.

Scott

[Jul 22 12:38:01:1595392681.388046:4:info] Scan process ended after forking.
[Jul 22 12:38:00:1595392680.380099:4:info] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/website/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=custom&cronKey=583cb11893b6150217ed3ecc69f454c9&k=b80a61e60632f1ae22722459fb19be9f892afc32bb5824f1bd4b79ad483320421a3cd1384f8699b10a7abd823084b5777d90f940c533786da5fcd78aa8bd1619bf54c1552e5b7c195e1ad82ef69f2f94&ssl=1&signature=18b8166f1b270c77c8c434b9e3ba10b3a4f7e629f8042f8c7bf179da9e1c50d7
[Jul 22 12:38:00:1595392680.377224:4:info] getMaxExecutionTime() returning config value: 20
[Jul 22 12:38:00:1595392680.376448:4:info] Got value from wf config maxExecutionTime: 20
[Jul 22 12:38:00:1595392680.374688:4:info] Entering start scan routine
[Jul 22 12:38:00:1595392680.358468:4:info] Ajax request received to start scan.
[Jul 22 12:37:53:1595392673.950988:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jul 22 12:37:53:1595392673.949268:1:info] Scan stop request received.
[Jul 22 12:36:18:1595392578.391325:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=b80a61e60632f1ae22722459fb19be9f892afc32bb5824f1bd4b79ad483320421a3cd1384f8699b10a7abd823084b5777d90f940c533786da5fcd78aa8bd1619bf54c1552e5b7c195e1ad82ef69f2f94&s=eyJ3cCI6IjUuNC4yIiwid2YiOiI3LjQuOSIsIm1zIjpmYWxzZSwiaCI6Imh0dHBzOlwvXC93d3cudGVjaGVkdC5jb20iLCJzc2x2IjoyNjg0NDM4MzksInB2IjoiNy4zLjIwIiwicHQiOiJmcG0tZmNnaSIsImN2IjoiNy4yOS4wIiwiY3MiOiJOU1NcLzMuNDQiLCJzdiI6IkFwYWNoZSIsImR2IjoiNS41LjY1LU1hcmlhREIifQ&betaFeed=0&action=timestamp
[Jul 22 12:30:31:1595392231.725194:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jul 22 12:30:31:1595392231.721354:1:info] Scan stop request received.
[Jul 19 20:50:05:1595163005.464499:1:info] Scheduled Wordfence scan starting at Sunday 19th of July 2020 08:50:05 PM
[Jul 16 20:50:14:1594903814.704892:1:info] Scheduled Wordfence scan starting at Thursday 16th of July 2020 08:50:14 PM
[Jul 13 20:50:01:1594644601.611266:1:info] Scheduled Wordfence scan starting at Monday 13th of July 2020 08:50:01 PM
[Jul 10 20:50:29:1594385429.988818:1:info] Scheduled Wordfence scan starting at Friday 10th of July 2020 08:50:29 PM
[Jul 07 20:52:21:1594126341.746506:1:info] Scheduled Wordfence scan starting at Tuesday 7th of July 2020 08:52:21 PM
[Jul 04 20:50:49:1593867049.549095:1:info] Scheduled Wordfence scan starting at Saturday 4th of July 2020 08:50:49 PM
[Jul 03 10:30:13:1593743413.280325:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jul 03 10:30:13:1593743413.279162:1:info] Scan stop request received.
[Jul 03 10:29:35:1593743375.366496:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jul 03 10:29:35:1593743375.362108:1:info] Scan stop request received.
[Jul 03 10:22:34:1593742954.253931:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jul 03 10:22:34:1593742954.251407:1:info] Scan stop request received.
[Jul 01 20:50:29:1593607829.112638:1:info] Scheduled Wordfence scan starting at Wednesday 1st of July 2020 08:50:29 PM
[Jun 28 20:50:06:1593348606.930587:1:info] Scheduled Wordfence scan starting at Sunday 28th of June 2020 08:50:06 PM
[Jun 25 20:50:04:1593089404.780109:1:info] Scheduled Wordfence scan starting at Thursday 25th of June 2020 08:50:04 PM
[Jun 22 20:50:05:1592830205.672426:1:info] Scheduled Wordfence scan starting at Monday 22nd of June 2020 08:50:05 PM
[Jun 22 02:19:24:1592763564.284204:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Jun 22 02:19:24:1592763564.282034:1:info] Scan stop request received.

Thanks for sending that over.

Something is killing the scans before anything is getting started. It appears Wordfence can connect back to your site, so the connectivity issue may be at the hosting level or something security-related on the hosting side, such as ModSecurity, or potentially an issue with a CDN configuration.

Can you check Wordfence > Tools > Diagnostics > Debugging Options and see what is enabled for both:

Start all scans remotely
Enable SSL Verification

Try scans with those options enabled, disabled, and offset. If the scans will not kick off at that point despite changing those settings, I recommend checking with your hosting provider to see if they are seeing anything killing the scans in their logs.

Scott

The host did try the traceroute as well as ping the noc1.wordfence.com as the log is showing Starting cron via proxy at URL https://noc1.wordfence.com/scanp/www.xxx.com/wp-admin/admin-ajax.php but seems the connection is being blocked from the Wordfence server itself, may refer to the below attached screenshot.
?
Can confirm if there is any blocking from Wordfence.
The below trace route as well ping result to the plugin provider :
?

[root@vps logs]# traceroute noc1.wordfence.com
traceroute to noc1.wordfence.com (69.46.36.28), 30 hops max, 60 byte packets
1 43.229.84.1 (43.229.84.1) 3.782 ms 3.573 ms 3.690 ms
2 103.36.95.249 (103.36.95.249) 1.537 ms 1.413 ms 1.417 ms
3 124.158.226.33 (124.158.226.33) 2.738 ms 2.648 ms 2.518 ms
4 xe-0-1-0-1.cr-gw-2-sin-pip.sg.globaltransit.net (124.158.224.241) 2.387 ms 2.449 ms 2.329 ms
5 ae-11.br-gw-2-sin-pip.sg.globaltransit.net (124.158.225.6) 2.672 ms 2.706 ms 2.640 ms
6 203.208.175.177 (203.208.175.177) 2.448 ms 2.570 ms 2.438 ms
7 203.208.173.138 (203.208.173.138) 178.894 ms 203.208.171.186 (203.208.171.186) 167.565 ms 203.208.182.249 (203.208.182.249) 2.922 ms
8 203.208.158.46 (203.208.158.46) 179.567 ms ae5.mpr1.pao1.us.zip.zayo.com (64.125.35.189) 174.407 ms 177.940 ms
9 ae9.cs1.sjc2.us.eth.zayo.com (64.125.27.188) 182.603 ms 203.208.172.234 (203.208.172.234) 169.680 ms 175.632 ms
10 ae0.cs2.sjc2.us.eth.zayo.com (64.125.28.141) 183.745 ms ae3.cs1.sea1.us.eth.zayo.com (64.125.29.43) 181.395 ms 177.095 ms
11 ae9.cs1.sjc2.us.eth.zayo.com (64.125.27.188) 188.870 ms ae1.mcs1.sea1.us.eth.zayo.com (64.125.28.133) 182.796 ms ae3.cs2.sea1.us.eth.zayo.com (64.125.29.41) 185.661 ms
12 ae1.mcs2.sea1.us.eth.zayo.com (64.125.29.23) 186.773 ms ae0.mcs2.sea1.us.eth.zayo.com (64.125.29.51) 182.357 ms 194.329 ms
13 ae1.mcs1.sea1.us.eth.zayo.com (64.125.28.133) 189.339 ms ae3.mpr1.sea26.us.zip.zayo.com (64.125.31.107) 193.742 ms 190.882 ms
14 ae1.mcs2.sea1.us.eth.zayo.com (64.125.29.23) 186.565 ms 182.463 ms 64.124.74.211.IDIA-235391-ZYO.zip.zayo.com (64.124.74.211) 259.027 ms
15 ae3.mpr1.sea26.us.zip.zayo.com (64.125.31.107) 186.084 ms * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
[root@vps logs]# ping -a noc1.wordfence.com
PING noc1.wordfence.com (69.46.36.28) 56(84) bytes of data.

^C
--- noc1.wordfence.com ping statistics ---
11 packets transmitted, 0 received, 100% packet loss, time 9999ms

[root@vps logs]# ^C