still scanning 6 hours later….
-
This has been happening for awhile now. I’ll get on my site in the morning and it just takes forever to move around the dashboard and I’ll check wordfence and sure enough it’s scanning- causing the slow response of anything under the hood. Then I see that it’s been scanning for over 6 hours, so I kill the scan. I just changed the max execution time for 15 seconds and it has been scanning for over 20 minutes now. That still seems too long. How long should a scan take? I need to be able to edit and get things done without the forever loading that scanning causes.
Another issue that has happened in the past is the long scanning is using up all the mysql and killing my site, making it redirect to the wp install page. With all these problems, maybe wordfence is just not for me.
-
Six hours is definitely not normal, but it depends on the content and settings on the site. Sometimes a scan will fail but appear to still be running — but if the site is noticeably slower until you kill it, it probably is still running. Do you see status updates in the second yellow box, showing how many files are scanned, every few seconds?
First, make sure that these options are not enabled:
Scan images and binary files as if they were executable
Enable HIGH SENSITIVITY scanningIt is usually also helpful to exclude the typical cache folders from scans, using the “Exclude files from scan that match these wildcard patterns” option. Most caches use either of these:
/wp-content/cache/*
/wp-content/wfcache/*This may decrease protection, but if you don’t have any indications that that the site is hacked, it will help ensure that all other parts of your installation are still scanned.
After the above options are disabled, and the exclusions are added, try running another scan — if it is still slow to finish, let me know and there are a few more things we can look at.
-Matt R
Okay, those two were enabled- so I unchecked them. Hopefully that will help! For the cache, do I just paste either of those (just as you have them written) into the ‘excluded…’ drop down? And how would I know which to paste there, or just both?
Thanks for the help 🙂
Yes, you can copy and paste both of those if you’re not sure which one is in use — also, if you do switch caches, both will still be covered.
After adding those and saving changes, let me know if the scan completes quickly enough. If you still have long scans there is a debugging option we can use to get a detailed scan log.
-Matt R
Well disabling those didn’t help… Haven’t done the cache yet but I don’t think it will matter. Why did it start a scan at midnight then another at 4:14 am (which is still running at 8:43 am?)
Scan Summary:
[Dec 11 00:01:24]Preparing a new scan.Done.
[Dec 11 00:01:24]Remote scan of public facing site only available to paid membersPaid Members Only
[Dec 11 00:01:26]Check if your site is being Spamvertized is for paid members onlyPaid Members Only
[Dec 11 00:01:28]Checking if your IP is generating spam is for paid members onlyPaid Members Only
[Dec 11 00:01:30]Scanning your site for the HeartBleed vulnerabilitySecure.
[Dec 11 00:01:31]Fetching core, theme and plugin file signatures from WordfenceSuccess.
[Dec 11 00:01:33]Fetching list of known malware files from WordfenceSuccess.-
THESE ARE STILL RUNNING:
[Dec 11 00:01:33]Comparing core WordPress files against originals in repository ….
[Dec 11 00:01:33]Comparing open source themes against WordPress.org originals….
[Dec 11 00:01:33]Comparing plugins against WordPress.org originals….
[Dec 11 00:01:33]Scanning for known malware files…..Here’s the scan details:
****[Dec 11 00:00:50] Scheduled Wordfence scan starting at Friday 11th of December 2015 12:00:50 AM****
[Dec 11 00:01:31] Contacting Wordfence to initiate scan
[Dec 11 00:01:31] Including files that are outside the WordPress installation in the scan.
[Dec 11 00:01:31] Getting plugin list from WordPress
[Dec 11 00:01:31] Found 17 plugins
[Dec 11 00:01:31] Getting theme list from WordPress
[Dec 11 00:01:31] Found 4 themes
[Dec 11 00:01:40] Analyzed 100 files containing 46.14 MB of data so far
[Dec 11 00:01:43] Analyzed 200 files containing 55.26 MB of data so far
[Dec 11 00:01:45] Analyzed 300 files containing 57.15 MB of data so far
[Dec 11 00:01:46] Analyzed 400 files containing 58.15 MB of data so far
[Dec 11 00:01:48] Analyzed 500 files containing 60.07 MB of data so far
[Dec 11 00:01:50] Analyzed 600 files containing 60.7 MB of data so far
[Dec 11 00:01:53] Analyzed 700 files containing 64.89 MB of data so far
[Dec 11 00:01:56] Analyzed 800 files containing 71.18 MB of data so far
[Dec 11 00:01:59] Analyzed 900 files containing 77.31 MB of data so far
[Dec 11 00:02:02] Analyzed 1000 files containing 83.67 MB of data so far
[Dec 11 00:02:05] Analyzed 1100 files containing 90.06 MB of data so far
[Dec 11 00:02:09] Analyzed 1200 files containing 95.65 MB of data so far
[Dec 11 00:02:11] Analyzed 1300 files containing 101.24 MB of data so far
[Dec 11 00:02:16] Analyzed 1400 files containing 110.66 MB of data so far
[Dec 11 00:02:18] Analyzed 1500 files containing 113.97 MB of data so far
[Dec 11 00:02:19] Analyzed 1600 files containing 114.47 MB of data so far
[Dec 11 00:02:21] Analyzed 1700 files containing 117.74 MB of data so far
[Dec 11 00:02:24] Analyzed 1800 files containing 119.24 MB of data so far
[Dec 11 00:02:27] Analyzed 1900 files containing 120.16 MB of data so far
[Dec 11 00:02:31] Analyzed 2000 files containing 124.42 MB of data so far
[Dec 11 00:03:01] Analyzed 2100 files containing 126.99 MB of data so far
[Dec 11 00:03:04] Analyzed 2200 files containing 127.93 MB of data so far
[Dec 11 00:03:06] Analyzed 2300 files containing 128.47 MB of data so far
[Dec 11 00:03:10] Analyzed 2400 files containing 128.79 MB of data so far
[Dec 11 00:03:11] Analyzed 2500 files containing 129.49 MB of data so far
[Dec 11 00:03:13] Analyzed 2600 files containing 129.84 MB of data so far
[Dec 11 00:03:16] Analyzed 2700 files containing 130 MB of data so far
[Dec 11 00:03:18] Analyzed 2800 files containing 130.21 MB of data so far
[Dec 11 00:03:20] Analyzed 2900 files containing 130.36 MB of data so far
[Dec 11 00:03:24] Analyzed 3000 files containing 130.52 MB of data so far
[Dec 11 00:03:25] Analyzed 3100 files containing 130.75 MB of data so far
[Dec 11 00:03:26] Analyzed 3200 files containing 130.89 MB of data so far
[Dec 11 00:03:28] Analyzed 3300 files containing 131.64 MB of data so far
[Dec 11 00:03:30] Analyzed 3400 files containing 133.42 MB of data so far
[Dec 11 00:03:33] Analyzed 3500 files containing 140.86 MB of data so far
[Dec 11 00:03:38] Analyzed 3600 files containing 146.01 MB of data so far
[Dec 11 00:03:41] Analyzed 3700 files containing 146.5 MB of data so far
[Dec 11 00:03:43] Analyzed 3800 files containing 146.9 MB of data so far
[Dec 11 00:03:46] Analyzed 3900 files containing 147.5 MB of data so far
[Dec 11 00:03:49] Analyzed 4000 files containing 147.73 MB of data so far
[Dec 11 00:03:52] Analyzed 4100 files containing 148.03 MB of data so far
[Dec 11 00:03:54] Analyzed 4200 files containing 148.56 MB of data so far
[Dec 11 00:03:56] Analyzed 4300 files containing 148.65 MB of data so far
[Dec 11 00:04:50] Analyzed 4400 files containing 149.65 MB of data so far
[Dec 11 00:04:51] Analyzed 4500 files containing 150.2 MB of data so far
[Dec 11 00:04:54] Analyzed 4600 files containing 152.17 MB of data so far
[Dec 11 00:04:58] Analyzed 4700 files containing 152.95 MB of data so far
[Dec 11 00:05:00] Analyzed 4800 files containing 154.44 MB of data so far
[Dec 11 00:05:02] Analyzed 4900 files containing 155.17 MB of data so far
[Dec 11 00:05:04] Analyzed 5000 files containing 155.55 MB of data so far
[Dec 11 00:05:06] Analyzed 5100 files containing 156.58 MB of data so far
[Dec 11 00:05:07] Analyzed 5200 files containing 158.51 MB of data so far
[Dec 11 00:05:11] Analyzed 5300 files containing 159.04 MB of data so far
[Dec 11 00:05:13] Analyzed 5400 files containing 160.93 MB of data so far
[Dec 11 00:05:17] Analyzed 5500 files containing 163.22 MB of data so far
[Dec 11 00:05:19] Analyzed 5600 files containing 164.83 MB of data so far
[Dec 11 00:05:21] Analyzed 5700 files containing 165.28 MB of data so far
[Dec 11 00:05:23] Analyzed 5800 files containing 168.65 MB of data so far
[Dec 11 00:05:25] Analyzed 5900 files containing 173.01 MB of data so far
[Dec 11 00:05:29] Analyzed 6000 files containing 230.29 MB of data so far
[Dec 11 00:05:31] Analyzed 6100 files containing 230.37 MB of data so far
[Dec 11 00:05:32] Analyzed 6200 files containing 230.57 MB of data so far
[Dec 11 00:05:34] Analyzed 6300 files containing 230.78 MB of data so far
[Dec 11 00:05:36] Analyzed 6400 files containing 230.86 MB of data so far
[Dec 11 00:05:37] Analyzed 6500 files containing 231.07 MB of data so far
[Dec 11 00:05:38] Analyzed 6600 files containing 231.3 MB of data so far
[Dec 11 00:05:43] Analyzed 6700 files containing 240.48 MB of data so far
[Dec 11 00:05:55] Analyzed 6800 files containing 251.34 MB of data so far
[Dec 11 00:05:59] Analyzed 6900 files containing 259.32 MB of data so far
[Dec 11 00:06:04] Analyzed 7000 files containing 277.18 MB of data so far
[Dec 11 00:06:08] Analyzed 7100 files containing 285.33 MB of data so far
[Dec 11 00:06:10] Analyzed 7200 files containing 288.63 MB of data so far
[Dec 11 00:06:13] Analyzed 7300 files containing 298.88 MB of data so far
[Dec 11 00:06:19] Analyzed 7400 files containing 312.81 MB of data so far
[Dec 11 00:06:24] Analyzed 7500 files containing 340.6 MB of data so far
[Dec 11 00:06:27] Analyzed 7600 files containing 352.62 MB of data so far
[Dec 11 00:06:32] Analyzed 7700 files containing 363.38 MB of data so far
[Dec 11 00:06:37] Analyzed 7800 files containing 380.29 MB of data so far
[Dec 11 00:06:43] Analyzed 7900 files containing 396.14 MB of data so far
[Dec 11 00:06:48] Analyzed 8000 files containing 406.47 MB of data so far
[Dec 11 00:07:45] Analyzed 8100 files containing 418.47 MB of data so far
[Dec 11 00:07:51] Analyzed 8200 files containing 435.32 MB of data so far
[Dec 11 00:07:56] Analyzed 8300 files containing 451.3 MB of data so far
[Dec 11 00:08:03] Analyzed 8400 files containing 466.09 MB of data so far
[Dec 11 00:08:10] Analyzed 8500 files containing 476.76 MB of data so far
[Dec 11 00:08:14] Analyzed 8600 files containing 490.97 MB of data so far
[Dec 11 00:08:19] Analyzed 8700 files containing 503.49 MB of data so far
[Dec 11 00:08:23] Analyzed 8800 files containing 512.5 MB of data so far
[Dec 11 00:09:14] Analyzed 8900 files containing 523.61 MB of data so far
[Dec 11 00:09:22] Analyzed 9000 files containing 557.75 MB of data so far
[Dec 11 00:09:38] Analyzed 9100 files containing 574.53 MB of data so far
[Dec 11 00:09:42] Analyzed 9200 files containing 584.69 MB of data so far
[Dec 11 00:09:46] Analyzed 9300 files containing 589.64 MB of data so far
[Dec 11 00:09:50] Analyzed 9400 files containing 599.11 MB of data so far
[Dec 11 00:09:54] Analyzed 9500 files containing 607.79 MB of data so far
[Dec 11 00:10:00] Analyzed 9600 files containing 630.18 MB of data so far
[Dec 11 00:10:04] Analyzed 9700 files containing 638.6 MB of data so far
[Dec 11 00:11:17] Analyzed 9800 files containing 658.36 MB of data so far
[Dec 11 00:11:23] Analyzed 9900 files containing 674.82 MB of data so far
[Dec 11 00:11:26] Analyzed 10000 files containing 683.1 MB of data so far
[Dec 11 00:11:32] Analyzed 10100 files containing 697.02 MB of data so far
[Dec 11 00:11:40] Analyzed 10200 files containing 710.97 MB of data so far
[Dec 11 00:11:44] Analyzed 10300 files containing 716.39 MB of data so far
[Dec 11 00:11:48] Analyzed 10400 files containing 721.69 MB of data so far
[Dec 11 00:11:53] Analyzed 10500 files containing 732.02 MB of data so far
[Dec 11 00:11:58] Analyzed 10600 files containing 741.4 MB of data so far
[Dec 11 00:12:02] Analyzed 10700 files containing 746.22 MB of data so far
****[Dec 11 04:14:34] Scheduled Wordfence scan starting at Friday 11th of December 2015 04:14:34 AM****It’s unusual for scans to run twice in one day. Usually issues with scans running close together are because WordPress’s wp-cron is not running jobs when they should run — sometimes that is just a side-effect of caching. (If all visitors are served cached files for a long time, WordPress can’t start wp-cron jobs until a visit hits a non-cached page or part of wp-admin.)
The cache exclusion is still likely to help — since you turned off scanning image and binary files, 746 MB of data shown in the scan log is quite a lot of data.
Still, scans shouldn’t normally stop just because they’re running for a while. Some hosts limit the amount of CPU time that sites can use (or other items), which could be the cause in cases like this. Since you mentioned adjusting the max execution time already, you might have already seen this, but just in case, there are more troubleshooting steps here:
My scans don’t finishYou can also turn on the option, “Enable debugging mode” to get a lot more details in the scan log, which can sometimes help. If you click the “Email activity log” link above the Scan Detailed Activity box, you can also send me the full log, with some other details about the server — just enter my email address: mattr (at) wordfence.com
-Matt R
Okay sent you detailed activity log and added those caching files (asterisk included right?) I’m worried about enabling the debugging because if it uses more database it might make my site redirect to wp install page because of too much mysql, or is my thinking wrong? Too many queries and my site is done for until it restarts the next hour and with it being the weekend my site has many more visitors! I would try it during the week.
Thanks.
Thanks for sending the log. That’s right that if your host limits MySQL usage, it could hit the limit. (Sorry, I forgot about that since it’s not common for most hosts these days.) It is possible that the limit on queries is the problem, but it’s hard to say.
Even without the debugging details, the scan log at least does show that the scan is ending in different places, so that helps, but it also means that there is something inconsistent about the problem, unfortunately.
Anyway, yes, do include the asterisk in the file exclusion box, to exclude the cache folders. Let me know how the next scan goes after doing that. Thanks!
-Matt R
Okay so I now see it has ran a scan again (3 in one day?) but it did finish!
[Dec 11 18:03:30] Scan Complete. Scanned 10600 files, 17 plugins, 4 themes, 633 pages, 426 comments and 43316 records in 607 seconds.
I hope it doesn’t scan so many times like this on a daily basis… I may have to disable automatic scanning. Why so many?
Thanks
607 seconds sounds a lot better, but 3 scans in one day still isn’t normal. Sometimes two will happen, from the caching issue above, where the previous day’s scan was deferred until the current day if no visitors reached a page that wasn’t already cached.
How has it been going the past few days, since your last post?
-Matt R
Well I had to disable automatic scanning. It was doing it again (like right the next day) scanning for hours and hours and hours. 🙁 I haven’t run a scan yet since then so I don’t know if it will just keep scanning or not. I will do a manual scan today.
Thanks
If the scan results still appear, can you scroll back and see the time that it started, and the time of the last message? Most of the time when a scan appears to run for hours, there was a problem with the last process that was running, and each stage may only run for 15-30 seconds in your case, but since it was ended in an unusual way (usually a timeout on the server), the scan results don’t show that it finished.
On other item to check that sometimes causes issues that are hard to track down — if using W3 Total Cache on the site, do you have the “database cache” enabled? Most of the other options are usually ok, but this option sometimes causes trouble with a number of plugins, including Wordfence’s scans.
-Matt R
The database cache is disabled (I think I changed that when we first started discussing this problem) and I am currently running a manual scan and this error just popped up:
An error occurredA scan is already running. Use the kill link if you would like to terminate the current scan.
I only clicked the ‘start scan’ button one time so I don’t understand this error (and automatic scanning has been disabled.) I ‘x’ out of the error and it’s continued scanning but I think it’s stuck again-
[Dec 17 11:58:31]Preparing a new scan.Done.
[Dec 17 11:58:31]Remote scan of public facing site only available to paid membersPaid Members Only
[Dec 17 11:58:33]Check if your site is being Spamvertized is for paid members onlyPaid Members Only
[Dec 17 11:58:35]Checking if your IP is generating spam is for paid members onlyPaid Members Only
[Dec 17 11:58:37]Scanning your site for the HeartBleed vulnerabilitySecure.
[Dec 17 11:58:39]Fetching core, theme and plugin file signatures from WordfenceSuccess.
[Dec 17 11:58:41]Fetching list of known malware files from WordfenceSuccess.
[Dec 17 11:58:42]Comparing core WordPress files against originals in repository …………….
[Dec 17 11:58:42]Comparing open source themes against WordPress.org originals………………
[Dec 17 11:58:42]Comparing plugins against WordPress.org originals……..
[Dec 17 11:58:42]Scanning for known malware files………..So far nothing has changed in 17 minutes. It’s just still doing the chasing squares thing after those last 4 items above.
Since automatic scanning was disabled, I’m not sure why that error would appear either, unless a previous scan that you had attempted was not killed. (This generally doesn’t take up any resources when a scan hangs, but the animated squares do make it look like it’s still trying.)
Do you know where to find your site’s error log? On some hosts, you may have to turn it on, and on some, they might be in different locations in the control panel or folders you can access, or even multiple folders — if there is one in the root of the site (usually error_log in that case). The hosting company could help you find it if you’re not sure where to look.
If you see any errors at the end of the error log after starting a new scan, those may help narrow down the issue. If there are lots of errors, just post the last few here.
-Matt R
- The topic ‘still scanning 6 hours later….’ is closed to new replies.
