Mike Clarke

Thanks for the suggestions.

Many of our plugins are essential for normal operation of our site so I shall have to do some testing on the development version when time permits. One thing that I have now noticed that the problem doesn’t affect users who are logged in – debugging this is going to be ‘interesting’.

/wp-content/plugins/rvg-optimize-database/logs/ was empty.

On checking the backups I can see that rvg-optimize-db-log.html existed in that directory at 23:10 on January 6th but the directory was empty at 05:10 on January 7th.

Could it be that the file was deleted in the course of the upgrade from 4.4.2 to 4.4.3 at 01:01 on January 7th ?

I’ve restored rvg-optimize-db-log.html from the backup and the buttons for viewing and deleting the logfile are now visible and working. I’ve run a manual optimisation and confirmed that the results were appended to the logfile.

Well it’s run for a few days now and survived two upgrades without dropping into learning mode. Looks like Sod’s law applies and things won’t go wrong when you want them to.

If the problem arises again I should be able to produce “before” and “after” copies of the contents of wflogs because I’ve set up a cron job to retain periodic backups of it.

It would be useful if I could make the cron job check to see if learning mode had been activated. Is there some value I could check in a config file or the database?

The previous times this happened there had been a time lag between the upgrade and dropping into learning mode suggesting that it might be happening when a cron job ran after the upgrade so I’d left things to follow their own courses.

Wordfence has upgraded itself and the WAF is still fully enabled so I’ll leave things as they are until tomorrow and see what happens overnight.

bash-3.2$ ls -l wp-content/wflogs/
total 228
-rw-rw—- 1 sedbergh1 83005 40083 Jul 27 21:25 attack-data.php
-rw-rw—- 1 sedbergh1 83005 8302 Jul 27 21:27 config.php
-rw-rw—- 1 sedbergh1 83005 51 Jul 27 20:19 ips.php
-rw-rw-r– 1 sedbergh1 83005 101240 Jul 18 07:08 rules.php
-rw-rw—- 1 sedbergh1 83005 44202 Jul 18 07:08 wafRules.rules
bash-3.2$

I’ve emailed the diagnostics to you.

The firewall has remained in fully enabled mode subsequent to me switching learning mode off.

No other config.tmp have remained in the wflogs directory.

Here’s the current directory listing:

-rw-rw—- 1 sedbergh1 83005 40083 Jun 8 06:39 attack-data.php
-rw-rw—- 1 sedbergh1 83005 639417 Jun 8 10:03 config.php
-rw-rw—- 1 sedbergh1 83005 51 Jun 8 08:45 ips.php
-rw-rw-r– 1 sedbergh1 83005 101240 Jun 6 07:04 rules.php
-rw-rw—- 1 sedbergh1 83005 44202 Jun 6 07:04 wafRules.rules

Here’s the current contents of wflogs:

bash-3.2$ cd wp-content/wflogs/
bash-3.2$ ls -lt
total 1348
———- 1 sedbergh1 83005 0 Oct 23 2033 config.tmp.VxFzcR
-rw-rw—- 1 sedbergh1 83005 635016 May 22 11:31 config.php
-rw-rw—- 1 sedbergh1 83005 51 May 22 10:30 ips.php
-rw-rw—- 1 sedbergh1 83005 40083 May 22 04:38 attack-data.php
-rw-rw—- 1 sedbergh1 83005 44202 May 14 13:46 wafRules.rules
-rw-rw-r– 1 sedbergh1 83005 101240 May 14 13:46 rules.php
-rw-rw—- 1 sedbergh1 83005 349568 Mar 10 17:35 config.tmp.84qAjH
-rw-rw—- 1 sedbergh1 83005 98287 Jan 17 20:11 config.tmp.K4kCVJ
-rw——- 1 sedbergh1 83005 827 Jun 17 2016 config.tmp.arVpPP
-rw-r—– 1 sedbergh1 83005 824 Jun 17 2016 config.tmp.QupnEp

Some of the files predate the time when learning mode was switched on (16/05/2017, 19:34:02) so it doesn’t look as though the wflogs folder had been deleted. But I’m rather suspicious of config.tmp.VxFzcR which is dated several years into the future.

I’ve resolved the issue of the IP address for the request not matching the IP the user logged in from. He was using a laptop and moved from one location to another between logging in and uploading some files. At the second location he connected through a different ISP.

I’m confident that my site hasn’t been compromised, daily Wordfence scans are all clean and Gravityscan results don’t show any cause for concern.