Hi all
I was surprised to find some 80 records in the 'sessions' table even though the configuration variable dbsessions is not set.
Even more surprised to find that the number climbed to 30 minutes after I truncated the table!
Any insight in to this? I've seen MDL-84051. But that is about Moodle 4.5. This one is 4.1.15+ (Build: 20241219).
There should NOT be any records in that table if DB sessions set to 0.
However, this, for the first time, might be a good bug!!!
Suggest:
mysql -u root -p'password' -e "use moodle -N;select lastip from mdl_sessions;" > dbsess.txt;cat dbsess.txt;wc -l dbsess.txt
then use one of the IP addresses shown above with:
/usr/local/bin/slogs
echo 'One param.';
echo 'Given: '$1
echo 'Paused ... press ENTER to continue searching logs.';
read $keypress;
echo 'access_log';
fgrep $1 /var/log/httpd/access_log
echo 'ssl_error_log';
fgrep $1 /var/log/httpd/ssl_error_log
echo 'ssl_access_log';
fgrep $1 /var/log/httpd/ssl_access_log
echo 'error_log';
fgrep $1 /var/log/httpd/error_log
echo 'secure log';
fgrep $1 /var/log/secure
whatever log files you want to search.
What I found, those IP addresses weren't legit access, but rather, a bot/probe and candidates for blocking entire network from which it came.
'SoS', Ken
Using suggested scripts ... findings on a 4.5 highest site:
state 0 userid 0 sessdata NULL timecreated timemodified epoch timestamps same firstip and lastip the same.
When checking logs for IP addresses dumped to a text file from mdl_sessions:
52.31.x.x and 3.254.x.x
In logs:
"MoodleBot-LinkChecker"
/site/admin/registration/check.php
https://docs.moodle.org/en/Usage
Also happens with a highest 4.4 site on same server.
'SoS', Ken
Obviously, only Moodle HQ could answer the question.
However, will say this, in the past when local moodles registered with Moodle it updated info ... version, number of modules used, etc. A script part of cron would phone home and update as well as acquire info about new versions of core available. When that failed ... and it was broke around 3.10 or so for a while ... didn't get a listing of higher versions of Moodle core available, it was hard to figure out where the local code was going.
The IP addresses I shared were Amazon and are the servers my local moodles where attempting to communicate with. Useful for me as I block traffic at the network layer and knowing those IP's would give me info on what not to block.
'SoS', Ken
a 4.4.6+
mysql> select * from mdl_sessions;
+------+-------+----------------------------+--------+----------+-------------+--------------+---------------+---------------+
| id | state | sid | userid | sessdata | timecreated | timemodified | first | lastip |
+------+-------+----------------------------+--------+----------+-------------+--------------+---------------+---------------+
| 2822 | 0 | vj66q3sghk48j5pvad2fovuflh | 0 | NULL | 1741450681 | 1741450694 | 66.249.66.203 | 66.249.66.202 |
IP Address is a Google IP - now blocked.
another 4.4.6+
none
a m44sb
none
m45sb - most recent version - 4.5.2+ (Build: 20250214)
42 rows in mdl_sessions
last 2 rows
| 41 | 0 | mv2pe4elodpl2qjecf028hbp22 | 0 | NULL | 1741422644 | 1741422644 | 43.129.58.235 | 43.129.58.235 |
| 42 | 0 | f2sq6boie9dv9va4fdtn47p63a | 0 | NULL | 1741422650 | 1741422650 | 43.129.58.235 | 43.129.58.235 |
A stealthy IP from Japan ... now blocked.
Truncated table
Just updated to 4.5.2+ (Build: 20250214)
accessed server to see if mdl_sessions was still populated.
No. It is not.
So ????
'SoS', Ken
Don't think Moodle HQ 'listens' to these forums. They will attempt to address something reported in tracker.
https://tracker.moodle.org/secure/Dashboard.jspa
You will have to provide a way to replicate the issue you are seeing. All I have been able to do is share what I see on servers to which I have access.
From what I saw in logs of those servers ... has something to do with updating information from your server to moodle's stats - id's now as a "Moodle Bot" in servers logs.
In a 4.4.highest sandbox, truncated mdl_sessions table yesterday. Just checked mdl_sessions table.
Here's a clip of contents now:
| 1133 | 0 | b2anaeuc4q2b6o42idj7957gqu | 0 | NULL | 1741042811 | 1741042811 | 51.222.253.2 | 51.222.253.2 |
| 1134 | 0 | o7lu3dlb515epm84o5m5vucltn | 0 | NULL | 1741156940 | 1741156940 | 51.222.253.18 | 51.222.253.18 |
| 1135 | 0 | 5k0tkjnbmi4ara7aasanqck3hr | 0 | NULL | 1741289424 | 1741289424 | 51.222.253.20 | 51.222.253.20 |
| 1136 | 0 | n19ahr0se1pkquth8msgf1vm7m | 0 | NULL | 1741289764 | 1741289764 | 3.254.194.112 | 3.254.194.112 |
| 1137 | 0 | u3qjb5u7cb016t3eqf9j41b4dv | 0 | NULL | 1741343158 | 1741343158 | 51.222.253.1 | 51.222.253.1 |
| 1138 | 0 | aobjfhgklm5ai7bahrdgrcv7i3 | 0 | NULL | 1741347810 | 1741347810 | 51.222.253.18 | 51.222.253.18 |
| 1139 | 0 | 4bd4htifd2ljqvv233tp3eenv4 | 0 | NULL | 1741351373 | 1741351373 | 51.222.253.20 | 51.222.253.20 |
| 1140 | 0 | 4ocjk0bbrhsd4r7t1qo2nr8v0g | 0 | NULL | 1741355983 | 1741355983 | 51.222.253.9 | 51.222.253.9 |
| 1141 | 0 | hisi4k87a5ltd98vr2ut3t0tar | 0 | NULL | 1741373446 | 1741373446 | 51.222.253.6 | 51.222.253.6
the time stamp of one:
1741373446
GMT: Friday, March 7, 2025 6:50:46 PM
Your time zone: Friday, March 7, 2025 12:50:46 PM GMT-06:00
Relative: A day ago
IP 3.254.194.112 is Amazon
IP 51.222.253.9 is also Amazon
From past issues on notifications, was informed that Moodle HQ does use Amazon but would not publish those IP addresses - for security reasons ... and was also informed, they change from time to time.
Here's a clip from logs - my server is sos2. It has a Moodle 4.4.highest sandbox in a directory called m44sb. Old clips, but ... this is a quickie reponse!
sos2_access_log-20250302:3.254.194.112 - - [26/Feb/2025:10:33:03 -0600] "HEAD /m44sb HTTP/1.1" 301 - "-" "MoodleBot/4.5 (+https://stats.moodle.org)"
sos2_access_log-20250302:3.254.194.112 - - [26/Feb/2025:10:33:03 -0600] "HEAD /m44sb/ HTTP/1.1" 200 - "-" "MoodleBot/4.5 (+https://stats.moodle.org)"
From what I gather, those are my sandbox phoning home (stats) to update stats on changes to that site - whatever stats are collected ... which I don't think is more than things like quiz instances, forum instances, hvp instances, etc. Not the content.
How about you share the same here!
'SoS', Ken
I think however that some records are still saved in the table and then cleared out. Not sure why. Thanks for the reminder that I probably need to clear mine out again - mine had over 2 million records when I was having site issues!!
Yes, it is exactly that.