wflogs config files issue

  • Resolved imnotgroot

    (@imnotgroot)


    5 years, 6 months ago

    We recently started using Azure linux(php 5.6) app service to host our multisite wordpress installation. The wordfence(version 7.3.2) is not working properly after it was installed. The web application firewall is currently in learning mode. It seems it does not allow to be switched to ‘acitve’ mode(enabled and protecting). It switches back to learning mode every time I tries to manually enable WAF. I also notice that couple of files kept getting removed from wflogs folder(config.php,config-transient.php,config-livewaf.php). Error log repeatedly shows “unable to open” these files for reading and writing. The following are couple of examples:

    [17-May-2019 01:48:53 UTC] Unable to open /home/site/wwwroot/wp-content/wflogs/config-transient.php for reading and writing.
    [17-May-2019 01:50:21 UTC] Unable to open /home/site/wwwroot/wp-content/wflogs/config-livewaf.php for reading and writing.
    [17-May-2019 01:51:12 UTC] Unable to open /home/site/wwwroot/wp-content/wflogs/config-transient.php for reading and writing.
    [17-May-2019 01:51:13 UTC] Unable to open /home/site/wwwroot/wp-content/wflogs/config.php for reading and writing.

    I do see those files created in wflogs folder sometimes. However it seems they are deleted almost instantly after creation. I ran tools->diagnostic. Everything seems fine except “File “config.php” does not exist”(for “Checking if web server can read/write from ~/wp-content/wflogs”) would show up under filesystem section sporadically. I also tried disable application firewall which seems fixed the config files being removed from wflogs folder issue. However “wafStatus” value in wflogs/config.php reads “learning mode” instead of “disabled”. Once WAF is re-enabled, Errors reappear again.

    I also checked the owner of wflogs folder. It is not the process owner. The permission on the folder and its files are set to 777. We tried remove the folder couple of times. The ownership and permission stayed the same after the folder was regenerated. I have consulted server admin. The ownership and permission of folders and files should stay as is.

    I am wondering if anybody has encountered this issue before? Any input are greatly appreciated.

Viewing 1 replies (of 1 total)

  • Hi @imnotgroot,

    Is your Azure hosting on an instance? Note that Wordfence’s wflogs requires the use of a real file system.

    We’ve had users report that running Wordfence on Azure or AWS instances results in /wflogs being cleared upon restart or at random intervals.

    Can you confirm with your hosting to make sure that you do not have an instance?

    Dave

Viewing 1 replies (of 1 total)
  • The topic ‘wflogs config files issue’ is closed to new replies.