• Resolved jannis01

    (@jannis01)


    Hi support,

    there seems to be an issue with the plugin tables. Today we had on our shop-topbar following string displayed:
    rg.pohsmolals@ofni” target=”_blank”>

    https://prnt.sc/ss6k8k

    First we thought of a plugin misbehavior or a hack but after exporting the database we couldn’t re-import the DB on the testing site because of the following error:

    ERROR 1062 (23000) at line 404943: Duplicate entry ‘\x1F\xF55g\xCC\x80<\x17\xD5\x87\x13BY\xDC$?’ for key ‘PRIMARY’
    Error found during database restore.

    Line 404943 seems to be a WF table that causes the error. The table is too big to paste it in here but the starting line is:

    INSERT INTO sl_wffilemods ( filenameMD5, filename, knownFile, oldMD5, newMD5, SHAC, stoppedOnSignature, stoppedOnPosition, isSafeFile) VALUES
    (UNHEX(‘1FF53567CC803C17D587134259DC243F’),………….

    To get the shop fast error-free again we had to disable the WF plugin (which crashed the site totally at first) deleted the fast-cgi cache and enable the WF plugin again.

    It’s not the first time that the WF creates rubbish data in the DB and every time we have to go through the same not so “customer friendly” procedure to clean up the site again, so my question is if there is an alternative method to clean up the plugins tables or rubbish-entries without crashing the whole shop?

    Best Regards,
    Jannis

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)
  • Hey @jannis01,

    This table relates to the file scanning feature. Can you please try completely resetting Wordfence and let me know if it helps?

    https://www.wordfence.com/help/advanced/remove-or-reset/#remove-or-reset

    Please let me know how it goes.

    Thanks,

    Gerroald

    Thread Starter jannis01

    (@jannis01)

    Hello Gerroald,

    deactivating and reactivating the plugin, with setting “Delete Wordfence tables and data on deactivation” to enabled, fixed the error in the topbar but the Firewall is in the learning mode again for a week or so.

    This happens not that often but it happens here and then and mostly on the header part of the site… As described before the whole procedure with deactivating/activating the plugin does fix the errors but crashes the whole site and kicks out all visitors!

    Is there a way to reset the tables or at least the affected ones to a clean-state without deactivating the plugin?

    Thanks,
    Jannis

    Hey @jannis01,

    The code below is the SQL command to DELETE the records. If this doesn’t fix the issue you’ll want to DROP and CREATE the table, which is the second SQL command below.

    DELETE FROMsl_wffilemods` (
    filenameMD5 binary(16) NOT NULL,
    filename varchar(1000) NOT NULL,
    knownFile tinyint(3) unsigned NOT NULL,
    oldMD5 binary(16) NOT NULL,
    newMD5 binary(16) NOT NULL,
    SHAC binary(32) NOT NULL DEFAULT ‘\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0’,
    stoppedOnSignature varchar(255) NOT NULL DEFAULT ”,
    stoppedOnPosition int(10) unsigned NOT NULL DEFAULT 0,
    isSafeFile varchar(1) NOT NULL DEFAULT ‘?’,
    PRIMARY KEY (filenameMD5)
    );`

    DROP TABLE sl_wffilemods;
    CREATE TABLE <code>sl_wffilemods</code> (
      <code>filenameMD5</code> binary(16) NOT NULL,
      <code>filename</code> varchar(1000) NOT NULL,
      <code>knownFile</code> tinyint(3) unsigned NOT NULL,
      <code>oldMD5</code> binary(16) NOT NULL,
      <code>newMD5</code> binary(16) NOT NULL,
      <code>SHAC</code> binary(32) NOT NULL DEFAULT '\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0',
      <code>stoppedOnSignature</code> varchar(255) NOT NULL DEFAULT '',
      <code>stoppedOnPosition</code> int(10) unsigned NOT NULL DEFAULT 0,
      <code>isSafeFile</code> varchar(1) NOT NULL DEFAULT '?',
      PRIMARY KEY (<code>filenameMD5</code>)
    );

    Please make sure to make a backup before making any database edits just_in_case.

    Thanks,

    Gerroald

    Thread Starter jannis01

    (@jannis01)

    Thank you very much for the effort Gerroald!

    Best Regards,
    Jannis

    Hey @jannis01,

    You bet! However, I just noticed the formatting on the first command broke it. Below should work without error.

    https://pastebin.com/vj099t1q

    Thanks again,

    Gerroald

    • This reply was modified 5 years, 11 months ago by WFGerroald.
Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Error in Database caused by WF’ is closed to new replies.