Support » Plugin: Wordfence Security - Firewall & Malware Scan » wfWAFStorageFileException: Unable to verify temporary file contents for…

  • I’m running WordPress 4.7.3 and Wordfence 6.3.5 for a few years, quite satisfied.

    Suddenly, I started getting alert emails stating that my wordfence scans were being terminated after running for 3 hours. I tried running manual scans and it would stall in the first step, where it counts how many files it will scan.

    After some digging, I found out there were 250k+ files with names like config.tmp.ajZMdi and rules.tmp.AEdyMx, all of those with zero bytes.

    After manually removing the files, I could run the scans again. However, after half an hour there were a few hundred new tmp files on the same folder! (For now, I have a cron rule removing all those files, but it’s just a temporary workaround).

    I know there’s a similar support topic marked as solved — https://wordpress.org/support/topic/error-unable-to-verify-temporary-file-contents-for-atomic-writing/ — but I’m not sure I have the same issue. I can login and my scans work (after I delete the thousands of tmp files).

    I followed the instructions found there, nonetheless, to no avail: after renaming the wflogs folder and creating a new one, the firewall panel page shows an error:

    Error reading Wordfence Firewall config data, configuration file could be corrupted or inaccessible. Path: /redacted/wp-content/wflogs/config.php Click here to rebuild the configuration file.

    There are now four files (attack-data.php, config.php, ips.php, rules.php), all with zero bytes. The same files, plus another one (wafRules.rules), were present in the wflogs folder before I renamed it, but they had non-zero values.

    The permissions in both the old and the new wflogs folder are 770:

    drwxrwx---.  2 root   <wpgroup>  11M Apr  5  2017 wflogs
    
    [-rw-rw---- root      <wpgroup>   39K]  wflogs/attack-data.php
    [-rw-rw---- root      <wpgroup>   96K]  wflogs/config.php
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.0iFMsV
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.0p3YEv
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.1AKMH9
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.1EWAMA
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.616FI3
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.AJ2xnR
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.EQcakA
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.EXgl3n
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.FzE8NQ
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.I2POCq
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.iaQcRQ
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.Km7RX7
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.n9V0Vr
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.p5SjFL
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.R5Nguk
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.tCZXTh
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.tDsVgl
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.TJxEf1
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.ub0I4I
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.uUUqNs
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.WyALc4
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.Xmh7l5
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.yDHDSK
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/config.tmp.yrsjNV
    [-rw-rw---- root      <wpgroup>    51]  wflogs/ips.php
    [-rw-rw-r-- root      <wpgroup>   86K]  wflogs/rules.php
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.0bbvEk
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.0yjfl6
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.1ETpkn
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.1qiGCY
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.2rw7nz
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.4mAMzP
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.4zVrdU
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.9L1x9z
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.c72FMy
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.cE0a4Y
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.dYmbJK
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.EIbALn
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.fiPvyV
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.fLAsmn
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.JsC3MK
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.lnArmN
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.nVlC41
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.TURVmF
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.VAQ201
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.wQTW9P
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.WXyaF5
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.YHWF81
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.YVgakS
    [-rw-rw---- <wpuser>  <wpgroup>     0]  wflogs/rules.tmp.ztfO1E
    [-rwxrwx--- root      <wpgroup>   38K]  wflogs/wafRules.rules
    

    There’s a lot of entries on my debug.log file going like:

    Unable to verify temporary file contents for atomic writing.

    and

    PHP Fatal error:  Uncaught exception 'wfWAFStorageFileException' with message 'Unable to verify temporary file contents for atomic writing.' in /redacted/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php:31
    Stack trace:
    #0 /redacted/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php(538): wfWAFStorageFile::atomicFilePutContents('/redacted...', '<?php exit('Acc...')
    #1 [internal function]: wfWAFStorageFile->saveConfig()
    #2 {main}
      thrown in /redacted/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php on line 31
Viewing 4 replies - 1 through 4 (of 4 total)
  • Hi Rudá,
    Could you please make sure that this directory “wflogs” and all the files included within it have the same owner as your web server user? because I can see some files have “root” as the owner while others another one.
    Also, please check (Wordfence > Tools => Diagnostics => Filesystem) and make sure that the plugin can read/write from “~/plugins/wordfence/tmp”.

    Thanks.

    Thread Starter Rudá Almeida

    (@rudaalmeida)

    The diagnostics page of Wordfence says I have read / write access to ~/plugins/wordfence/tmp. I have changed all user/group ownership to the web server user and the issue persists. Disabling every other plugin except for Wordfence doesn’t fix the issue.

    I’m running

    – WordPress 4.7.3
    – Wordfence 6.3.5
    – PHP 5.6.30
    – CentOS Linux release 7.3.1611 (Core)

    Thread Starter Rudá Almeida

    (@rudaalmeida)

    As I said before, after renaming the wflogs folder and creating a new one, the firewall panel page shows an error:

    Error reading Wordfence Firewall config data, configuration file could be corrupted or inaccessible. Path: /redacted/wp-content/wflogs/config.php Click here to rebuild the configuration file.

    If I click on “rebuild”, nothing happens.

    There are now four files (attack-data.php, config.php, ips.php, rules.php), all with zero bytes. The same files, plus another one (wafRules.rules), were present in the wflogs folder before I renamed it, but they had non-zero values.

    Do you have SELinux configured on your server? may I know its status by running sestatus command if you have shell access?

    Also, when you say “creating a new one”, I want to make sure you mean that “wflogs” directory is getting regenerated by the plugin automatically, you didn’t recreate it manually or something.

    Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘wfWAFStorageFileException: Unable to verify temporary file contents for…’ is closed to new replies.