Error log flooded by "Unknown column 'attackLogTime' in 'field list'"

Hello MultiformeIngegno,
which version of Wordfence are you using?

6.1.5

Hello again,
Thanks. It sounds like your wfHits table has been corrupted. If you can access your database via phpMyAdmin or similar you can check and see if it’s corrupted and try to restore it. In phpMyAdmin you do this by

1. Click on your database in the database menu to the left
2. Check your blog_wfHits table
3. In the droplist that says “With selected” select “Check table”

.blog_wfHits
check
status
OK

Hello again,
Thanks for checking that. If you while in phpMyAdmin click on the table to view it, do you see a column called “attackLogTime”?

Nope, these are the columns that I have:

id	int(10)
ctime	double(17,6)
IP	binary(16)
jsRun	tinyint(4)
is404	tinyint(4)
isGoogle	tinyint(4)
userID	int(10)
newVisit	tinyint(3)
URL	text

What if I disable the plugin, remove all the tables related to WordFence and reinstall it again?

Hello MultiformeIngegno,
yes for some reason your table is missing several columns. I’m not sure if this is an old Wordfence database structure or if the columns have just gone missing.

I agree a clean sweep sounds like the right thing to do here. If you are able to save Wordfence options you can select “Delete Wordfence tables and data on deactivation?” on the Wordfence “Options” page and then deactivate and reactivate Wordfence. If you are not able to save options then you can do it manually.

And for reference, your wfHits table should look like this

id int(10) unsigned NOT NULL AUTO_INCREMENT
attackLogTime double(17,6) unsigned NOT NULL
ctime double(17,6) unsigned NOT NULL
IP binary(16) DEFAULT NULL
jsRun tinyint(4) DEFAULT '0'
statusCode int(11) NOT NULL DEFAULT '0'
isGoogle tinyint(4) NOT NULL
userID int(10) unsigned NOT NULL
newVisit tinyint(3) unsigned NOT NULL
URL text
referer text
UA text
action varchar(64) NOT NULL DEFAULT ''
actionDescription text
actionData text

I have the same issue – WF 6.1.8

I couldn’t deactivate WF, so just deleted the folder, tables, and anything I could find in the options table. I then reinstalled and reactivated WF, but my brand new wfHits table looks like below and doesn’t look like above:
—
— Table structure for table wp_wfHits
—

CREATE TABLE IF NOT EXISTS wp_wfHits (
id int(10) unsigned NOT NULL AUTO_INCREMENT,
ctime double(17,6) unsigned NOT NULL,
IP int(10) unsigned NOT NULL,
jsRun tinyint(4) DEFAULT ‘0’,
statusCode int(11) NOT NULL DEFAULT ‘200’,
isGoogle tinyint(4) NOT NULL,
userID int(10) unsigned NOT NULL,
newVisit tinyint(3) unsigned NOT NULL,
URL text,
referer text,
UA text,
PRIMARY KEY (id),
KEY k1 (ctime),
KEY k2 (IP,ctime)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=2 ;

I dug around more and wfSchema has this for table creation, so looks like the code isn’t creating the proper fields.

"wfHits" => "(
	id int UNSIGNED auto_increment PRIMARY KEY,
	ctime DOUBLE(17,6) UNSIGNED NOT NULL,
	IP int UNSIGNED NOT NULL,
	jsRun tinyint default 0,
	statusCode int NOT NULL default 200,
	isGoogle tinyint NOT NULL,
	userID int UNSIGNED NOT NULL,
	newVisit tinyint UNSIGNED NOT NULL,
	URL text,
	referer text,
	UA text,
	KEY k1(ctime),
	KEY k2(IP, ctime)
) default charset=latin1"

Hello Digitsoft,
the “attackLogTime” is added via an “ALTER” statement in “wordfence::runInstall”. Look at row 440 in wordfenceClass.php.

Is your install being interrupted before it completes? Or does your MySQL user lack “alter” privileges? You should be able to see if this is the case on your Wordfence “Diagnostics” page.

I didn’t dig far enough I guess ??

Install goes through without issue and the user has full rights.

Any other ideas?

I’ll keep digging around and see if I can come up with an answer.

Thanks again for WF!

I was able to get a re-install to work – it let me deactivate it this time, deleted the plugin through the admin, deleted the tables from the db, and removed the version number from the options table.

I still have no idea why it didn’t create the 4-6 fields before, but have to assume it’s an upgrade thing.

I’ll dig more when I have time to see if I can pinpoint it…

Thanks for the update Digitsoft, much appreciated. To me it sounds like the install/upgrade got interrupted somehow. If you find a better answer, do let me know. Thanks!

I’m going to restore a backup of the site and see if I can find an answer.