No row for frame

[px03afk]

I've just found a bunch of errors in the log which come from web_php which read 'No row for Frame'. They seem to be transient and not causing any obvious issue. I was wondering what causes them.

[bbunge]

I've just found a bunch of errors in the log which come from web_php which read 'No row for Frame'. They seem to be transient and not causing any obvious issue. I was wondering what causes them.

Linux distro and version? Camera info? Instructions you used to install Zoneminder?

bb

[bbunge]

I've just found a bunch of errors in the log which come from web_php which read 'No row for Frame'. They seem to be transient and not causing any obvious issue. I was wondering what causes them.

Linux distro and version? Camera info? Instructions you used to install Zoneminder?

viewtopic.php?f=36&t=24846

bb

[px03afk]

Sorry, should have thought to provide that information. I am running ZM 1.30.2 on OpenSuse Leapwith Foscam FI8918W and FI8904W cameras. I always compile ZM from source.

On looking a little more at the errors I find that the pids are pointing at an httpd-prefork process and the apache error log is showing PHP Notice: Undefined property: Frame::$Id in /srv/www/htdocs/zoneminder/includes/Frame.php on line 73. Then I started looking even deeper and discovered that there was a Bot trying to access my ZM data and that was causing the error. Still not entirely sure what the error means but it did lead me to blocking a couple of rogue IP addresses.

[rockedge]

how did you find the Bot? I have had some errors I have not seen before lately.

[px03afk]

Because the pids in question were httpd-prefork I looked in the apache error log and that is where I saw reference to a Bot.

[asker]

I looked in the apache error log and that is where I saw reference to a Bot.

Is it possible to share the exact log?

[px03afk]

Turns out that this is a Russian search engine at yandex.com. Initially I blocked it by updating my web server but then I found that I could do it by URL in my router.

The error_log entries are of this form:

[Wed Mar 15 08:36:56.829043 2017] [php5:error] [pid 9755] [client 37.9.122.203:5 2712] ERR [No row for Frame ]
[Wed Mar 15 08:36:56.885169 2017] [php5:error] [pid 9755] [client 37.9.122.203:5 2712] PHP Notice: Undefined property: Frame::$Id in /srv/www/htdocs/zoneminder/includes/Frame.php on line 73

There are entries in the access_log which look like this:

37.9.122.203 - - [17/Mar/2017:15:30:25 +0000] "GET /robots.txt HTTP/1.1" 404 101 1 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
37.9.122.203 - - [17/Mar/2017:15:30:29 +0000] "GET /zoneminder/?view=frames&eid=85843 HTTP/1.1" 200 2598 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"

[asker]

Wow, so bots are exploiting some past known vulnerabilities of ZM!
If I recall correctly, this issue of people being able to bypass security and view event images was fixed a few months ago.

[px03afk]

Correction to my previous message, my router isn't blocking so I'm glad I set up apache to do it for me.

[rockedge]

these are the errors that flooded my logs, then stopped... and just disappeared:

Code: Select all

2017-03-09 10:55:39.090772   zms      20825   ERR   Can't open /tmp/zm/zmswap-m5/zmswap-q938775/zmswap-i00198.jpg: No such file or directory   zm_image.cpp   869
2017-03-09 10:55:38.842998   zms      20825   ERR   Can't open /tmp/zm/zmswap-m5/zmswap-q938775/zmswap-i00197.jpg: No such file or directory   zm_image.cpp   869

thousands of these errors flooded the logs and Backtrace errors with them mixed in.

I was told the zmswap-xxx files are created during event playback. The thing was there were no events present...I removed them prior to these errors appearing. I thought a 3rd party program reading the ZM stream was the cause...now I am not so sure.
In any case the errors stopped and I can not duplicate them as of yet.