ips.log file constantly changed (not modified)

  • Resolved NickB

    (@nickwordify)


    1 year, 10 months ago

    Hey,

    Does anyone know if it’s normal for files in the wp-content/wflogs/ to be constantly changed (not modified)?

    As in changed being the meta data of the file is updated and changed being the contents are updated.

    Here’s an example:

    # stat wp-content/wflogs/ips.php
  File: 'wp-content/wflogs/ips.php'
  Size: 51              Blocks: 8          IO Block: 4096   regular file
Device: 802h/2050d      Inode: 302034102   Links: 1
Access: (0600/-rw-------)  Uid: ( 1017/slniiilb)   Gid: ( 1023/slniiilb)
Access: 2023-01-17 23:48:43.308023572 +0000
Modify: 2023-01-17 22:44:34.098200752 +0000
Change: 2023-01-17 23:48:43.301023010 +0000
 Birth: -

# date
Tue Jan 17 23:48:56 UTC 2023

    The contents always seems to be:

    <?php exit('Access denied'); __halt_compiler(); ?>

    If anyone knows of a way of making this stop we’d love to know ??

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @nickwordify, thanks for your question.

    The contents of this file is normal in your case, and it’s not uncommon to see the entire contents of wflogs updated very frequently (~20 minutes) due to rules, block list, and other updates.

    If you experience persistent problems with files in this folder but don’t see connectivity or permissions failures/error messages in your Wordfence > Tools > Diagnostics page, you can bypass this entirely by setting Wordfence to write to the MySQLi storage engine instead of a file: https://www.wordfence.com/help/firewall/mysqli-storage-engine/

    Thanks,
    Peter.

    Thread Starter NickB

    (@nickwordify)

    Thanks Peter, really appreciate the response.

    On some sites we’re seeing the “change” value update every 3-5 seconds… is that still normal? I only ask as you mentioned 20 mins.

    Good to know there’s a MySQL option for the storage engine. Thank you.

    Plugin Support wfpeter

    (@wfpeter)

    Hi @nickwordify,

    Is the last updated value on the file changing every 3-5 seconds or are you talking about an open process on this file? Any diagnostic information from your server to illustrate this may help me give a more accurate answer to your question.

    Thanks again,
    Peter.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘ips.log file constantly changed (not modified)’ is closed to new replies.