Wordpress and missing MYSQL db problem
Hello,
Two wp installations have been returning "Error establishing a database connection".
One of them (ABC) shows no databases or users set up.
The other( DEF) shows the corrects database and user.
Both are unreachable and went down almost simultaneously.
Last action I performed was an attempted wp update via cpanel.
These items in my error_log refer:
I read this post,
[2014-10-06 14:33:40 -0400] warn [cpwrap] cpwrap is deprecated, please use Cpanel::Wrap instead, caller info: [pid]=[31436] [exe]=[] [cmdline]=[/usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl] cwd=[/] at bin/cpwrap line 66
[2014-10-06 14:33:40 -0400] info [cpmysql] Dropping MySQL database abc_wp1 for user ABC
[2014-10-06 14:33:40 -0400] warn [cpwrap] cpwrap is deprecated, please use Cpanel::Wrap instead, caller info: [pid]=[31436] [exe]=[] [cmdline]=[/usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl] cwd=[/] at bin/cpwrap line 66
[2014-10-06 14:33:40 -0400] info [cpmysql] MYSQL: Remove dbuser ABC_wp1 for owner ABC on 178.3xxcc.10
[2014-10-06 14:33:40 -0400] warn [servers_queue] Cannot queue task dbstoregrants binval ( no id, probably a duplicate ) at /usr/local/cpanel/Cpanel/LoggerAdapter.pm line 26
Cpanel::LoggerAdapter::warn(Cpanel::LoggerAdapter=HASH(0x1ca8748), 'Cannot queue task dbstoregrants ABC ( no id, probably a duplicate )') called at /usr/local/cpanel/bin/servers_queue line 90
main::queue_tasks('dbstoregrants binval') called at /usr/local/cpanel/bin/servers_queue line 75
[2014-10-07 15:07:36 -0400] info [cpses_tool] MYSQL: Remove dbuser cpses_biwbp9vAeU for owner ABC on 174.3xxcc.10
[2014-10-07 15:11:47 -0400] info [cpses_tool] MYSQL: Remove dbuser cpses_glo67sphCD for owner DEF on 174.3xxcc.10I read this post,
-
Hello :) Do you have a backup of the account or database available so you can restore the database? It will likely need to be restored if it does not exist in the /var/lib/mysql directory. Thank you. 0 -
mysql> use abc_wp1 ERROR 1049 (42000): Unknown database 'abc_wp1' mysql> Write failed: Broken pipe I have a backup of the account in /backup/cpbackup/monthly/abc/mysql. I need to know how and why this happened and how to fix it. 0 -
You could review the cPanel access log to see if someone with access to that account removed the database. It's located at: /usr/local/cpanel/logs/access_log You would need to use "grep" to search for the account username to help filter down the results. Thank you. 0 -
Don't see in the access_log where db was removed . Looked in the bad behavior table in the backup dump and there are what looks like (in my not expert opinion) huge number of links spams and other unhealthy stuff ??\nredirect_to: http://www.cnseay.com/wp-admin/\ntestcookie: 1\n','17566707'),(144530,'195.78.211.2','2014-09-24 01:00:21','HEAD','/','HTTP/1.0','HEAD / HTTP/1.0\n','','','00000000'),(144531,'100.43.81.129','2014-09-24 01:31:00','GET','/robots.txt','HTTP/1.1','GET /robots.txt HTTP/1.1\nConnection: Keep-Alive\nFrom: support@search.yandex.ru\nHost: www.youvebeenvalidated.com\nUser-Agent: Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)\n','Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)','','17566707'),(144296,'119.63.193.195','2014-09-21 04:55:02
All sorts of junk in the wp_users table . wp_options table etc,etc0 -
cPanel does not remove databases automatically. It's possible the database was dropped by someone with access to do so, or you may want to see if it's possible the account was exploited. Thank you. 0 -
Michael- yes but how? How do I see if it was exploited? 0 -
There's no single method of determining if an account was hacked. You can try searching for "wordpress hacked" on our forums or elsewhere to see how others determined the source of the attack. You can review the domain access logs for the account to see if you notice anything out of the ordinary. Thank you. 0
Please sign in to leave a comment.
Comments
7 comments