Scan process ended after forking error

Apache+mod_php

Actually, you’re correct, all the website I’m dealing with are hosted with the same company… Would that mean that something changed on their side ? I had the feeling it all started after upgrading to the first version of WordFence that included the FW…

Hello again,
well, if possible you could ask your host why it seems like you can not use “auto_prepend_file”. Perhaps they have some special settings that will be hard for us to guess.

Sounds like nothing changed on hosting side…

What kind of settings info do you need so that I can ask them ?

Hello,
it would be great if you could ask them why the auto_prepend_filedirective doesn’t seem to be working?

Hi,

Here are some details from the hosting company :

“we are not using litespeed but a modified version of Nginx. Also we’re using the PHP implementation usually found with Litespeed : lsphp.

regarding auto_append_file, you can find some relevant information there : https://desclos.org/info.php”

Thanks a lot for your help and support

Got some more details from the hosting company… the request is blocked because it uses all resources from the server when the scan is running making the site unavailable (error 500/502/503)…

Hello Frederic,
Rereading this thread I think I may have been confused about the issue. I apologize for that. Let’s see if I got it right now.

1. Your scans do not complete and you get a message saying “Scan process ended after forking”

2. Your hosting company reports that they are automatically terminating some processes due to them using too much memory?

Hello,

That’s exactly it.

If needed, I have a dev WP MU not used at the moment with wordfence installed… I can create a super-admin account for you so that you can see what’s going on… just give me an email address si that I can create the account for you.

Hello Frederic,
I’m afraid we’re not allowed to enter peoples hosting accounts via connections on WordPress forums. (We do offer such services for our premium customers but that’s via the premium support.)

It sounds very strange that the scan would be using all the resources from the server. I had an idea that maybe they had short PHP execution time but looking at the diagnostics you sent me earlier it looks like it’s longer than normal.

If you can check with your host if they can specify what exact processes are being terminated that might help. If the site is running out of memory there should be evidence of this in an error log. That could also give us some answers.

Hello,

Too bad as it may help you find out what’s going on… As most of my customer are hosted with the same company, I can hardly advise them to go for premium if it doesn’t fully work (by the way, I cannot either configure FW…)

Here is the answer from the hosting team :

“Issue comes from the hash md5 and the sql requests. part of the scan is doing lot of hash md5 wich is not a major issue even if it consumes lot of CPU but every hash generates a sql insert request and as the hash md5 are pretty quick, it saturates on the SQL side.

Ideally it would be better if the sql request coulb be grouped.

It’s more a CPU/SQL issue than memory consumption”.

From what I have seen since the issue appeared (as it worked previously) it stopped working around 24th of april, maybe a change in the plugin… If I remember correctly it was when the FW was introduced.

Thanks for your help and support
F.

Thanks Frederic,
I will forward that information to the dev team and see what they think. If it is something we can fix, I’ll let you know. Can’t make any promises though as this is the only report we have of this kind yet.

Hi Frederic,

Based on the responses from your hosting company, I would say the responsibility to fix this issue lies with them. Killing processes that are consuming too much memory is an OS level defense to prevent the server from crashing. In the case of MySQL, the settings should be tuned so that MySQL uses an appropriate amount of memory for the services running on that server. Additionally, swap space could be added to the server for low-memory environments. We do take performance seriously, and strive to make Wordfence work on as many hosting environments as possible, but this issue looks to be the result of a server misconfiguration.

Thanks,
Matt Barry, Wordfence Lead Developer