The current scan looks like it has failed

  • Resolved Mihai Papuc

    (@mihaipmp)


    5 months ago

    I have been getting this timeout error while scanning this site for a couple of weeks now. I have looked into all the recommended materials and similar requests from this forum (eg. https://www.ads-software.com/support/topic/scan-engine-error-the-signature-is-invalid/). I reset the plugin (removing all its data and reinstalling it), I modified the max execution time / step to 12, and I enabled debugging.
    Here are the last few lines from the debug log:

    [Oct 22 15:38:15:1729636695.479332:4:info] Setting up scanRunning and starting scan
    [Oct 22 15:38:15:1729636695.478234:4:info] Setting up error handling environment
    [Oct 22 15:38:15:1729636695.476406:4:info] Requesting max memory
    [Oct 22 15:38:15:1729636695.382269:4:info] Checking saved cronkey against cronkey param
    [Oct 22 15:38:15:1729636695.380667:4:info] Checking cronkey: 8bff7771734c658af02e3c2de7e9ee1d (expecting 8bff7771734c658af02e3c2de7e9ee1d)
    [Oct 22 15:38:15:1729636695.379479:4:info] Fetching stored cronkey for comparison.
    [Oct 22 15:38:15:1729636695.376399:4:info] Verifying start request signature.
    [Oct 22 15:38:15:1729636695.288254:4:info] Scan engine received request.
    [Oct 22 15:38:05:1729636685.483775:4:info] Scan process ended after forking.
    [Oct 22 15:38:04:1729636684.385128:4:info] Starting cron with normal ajax at URL https://site.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=custom&cronKey=8bff7771734c658af02e3c2de7e9ee1d&signature=109030b1a828633236222cc36a21601f3262bda0303552c8c813bc5528acde93
    [Oct 22 15:38:04:1729636684.382247:4:info] Cached result for scan start test: true
    [Oct 22 15:38:04:1729636684.381415:4:info] getMaxExecutionTime() returning config value: 12
    [Oct 22 15:38:04:1729636684.380584:4:info] Got value from wf config maxExecutionTime: 12
    [Oct 22 15:38:04:1729636684.293910:4:info] Calling startScan(true)
    [Oct 22 15:38:02:1729636682.201197:4:info] Entered fork()
    [Oct 22 15:38:02:1729636682.183762:4:info] Forking during malware scan (1875) to ensure continuity.

    During the test scan, I also enabled WP_DEBUG, but I did not get any relevant error in the debug log either.

    I am also sending the report by email to wftest at WF, mentioning my forum username in the report.

    Please let me know what other steps I could try to solve this problem.

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @mihaipmp, thanks for sending your diagnostic over.

    I see you’re using Litespeed, so noabort code usually needs to be added to stop communication stopping abruptly – usually during scans. This looks like what’s happening as I don’t often see scans failing during the “Setting up scanRunning and starting scan” phase: https://www.wordfence.com/help/advanced/system-requirements/litespeed/

    The max_execution_time on your server looks OK at 60, as Wordfence only tries to use half this value by default. Your change to the plugin execution time setting to 12 is fine, although you may be able to adjust it back if scans start working again with the above.

    Let us know how you get on!
    Peter.

    Thread Starter Mihai Papuc

    (@mihaipmp)

    Hi Peter, thank you for your quick reply.

    I implemented the first code snippet in .htaccess and in the system information I see the variable $_SERVER['noabort'] = 1. I assume this means that the code snippet worked.

    Unfortunately, the scan still failed, I tried it twice with debugging disabled.

    Right now I’m looking into configuring to skip the scan for some of the files (eg. we have a few mp3 files). If you have any other suggestions of things that I might try, please let me know.

    Plugin Support wfpeter

    (@wfpeter)

    Hi @mihaipmp, thanks for trying that out so quickly.

    Does the scan log still fail at the same point now? The reason why I ask is because getting further (or less far) intermittently, even with the noabort code could point to resources like memory being exhausted or timeouts related to file size or quantity of files being scanned.

    It could be worth trying the other code snippets to see if you get a different outcome with the scans, although seeing the variable reflected does sound like your first attempt took effect.

    Thanks again,
    Peter.

    Thread Starter Mihai Papuc

    (@mihaipmp)

    Hi Peter, thanks for your help!

    From all my attempts, it looks like the scan stops at different random points in the process.

    My last attempt was to exclude the uploads folder and large files, adding these lines to Advanced Scan Options – Exclude…:

    wp-content/uploads/*
    *.mp3
    *.zip

    In one attempt, the scan was stopped several times and resumed after a retry, until it stopped for good. In the second attempt, I changed the time limit per step to 30 (from 12), the scan stopped and never resumed again.

    For now, I’m taking a break from testing any option changes, and I will get back to this later in the week, maybe I’ll have some fresh ideas to try.

    Thanks again for your help so far!

    Plugin Support wfpeter

    (@wfpeter)

    Hi @mihaipmp,

    It looks like you’ve gone about things the right way, the execution time and exclusion of any larger files or directories that contain safe content could have certainly had a positive effect along with the Litespeed-specific change.

    One thing I’ll suggest in the mean time is that I noticed your?WP_MEMORY_LIMIT?could be set to?128M?or?256M?in?wp-config.php. WooCommerce, for example, recommend 64M minimum, so if you also have many hits on the site at once especially during a Wordfence scan, a lower limit like the?40M?I see in your diagnostic could be reached fairly easily. Also check your PHP?memory_limit?value matches or exceeds this value when making a change.

    Wordfence was reflecting the 512M that is available to administrators on your site, but the front-end pages rely on WP_MEMORY_LIMIT so could still be a factor.

    Let us know how you get on when you get back to troubleshooting!
    Peter.

Viewing 5 replies - 1 through 5 (of 5 total)
  • You must be logged in to reply to this topic.

Tags