Defender not loading audit log

Having an issue in Defender where it's not showing the audit logs, getting the following message:

Whoops, the time format used to access the Audit Log API was incorrect so we couldn't grad your logs. Please Try Again.

Thanks in advance!

  • Nazmul H. Rupok
    • The Incredible Code Injector

    Hi Hanna

    Hope you are doing well. Sorry to hear that you are having some trouble. I think this is something to do with your time format settings. Would you mind allowing support access so we can have a closer look at this on your end?
    To enable support access you can follow this guide here:
    http://premium.wpmudev.org/manuals/wpmu-dev-dashboard-enabling-staff-login/

    Please respond in this thread once access is granted.

    Best regards,
    Nazmul

  • Nazmul H. Rupok
    • The Incredible Code Injector

    Hi Hanna

    Hope you are doing great. Thanks for confirming as I was not sure which site to look for. I believe the issue is on frilledaboutf******.

    As mentioned on previous reply, the issue is related to your timezone settings. Looks like you have set your timezone to "Adelaide" - https://www.screencast.com/t/L0jIDd59Vwut

    Please change this to something like UTC+0 and hopefully it will show the log. I have tried it to make sure it works and set back to "Adelaide" again.

    Let me know if you still face any issue. I'll be happy to look further.

    Have a nice day. Cheers!
    Nazmul

  • Hanna
    • New Recruit

    I'm not sure what that has to do with the original issue but I changed as you requested. I never put the support ticket in so it is very light on details. The original issue is that I have over 16500 404 errors from ip addresses that are customers and some legitimate bots. I can't make sales if defender is blocking out customers. They are not failed login attempts because I just did one on purpose and you see quite clearly in the log that I was attempting to log in. Defender is costing me money by blocking legitimate customers.

    • Nazmul H. Rupok
      • The Incredible Code Injector

      Hi Hanna

      Hope you are doing great today. I am sorry but I didn't see such issue on this ticket. Would you check the ticket description and confirm if something missing here? Or you are referring any other ticket? I can't see any chat history either. Is there any chance you describe the blocking issue on chat?

      Please let me know so that I could assist on this better.

      Have a nice day. Cheers!
      Nazmul

  • Hanna
    • New Recruit

    I don't know what else you want me to say. As I previously stated I didn't put the support ticket in, the person from the chat did, and they only put limited information on the support ticket (they only included one of the issues defender was doing at the time). And, as I previously stated - The original issue is that I have over 16500 404 errors from ip addresses that are customers and some legitimate bots. I can't make sales if defender is blocking out customers. They are not failed login attempts because I just did one on purpose and you see quite clearly in the log that I was attempting to log in. Defender is costing me money by blocking legitimate customers.
    It's now over 17600.... If you do searches on the IPs they are legit IP addresses.

    This also happens in a second site I have defender on. I literally received over 20 emails a day from defender stating that they have blocked someone out. Why when they are legitimate customers?? View the Ip lockout logs in defender.

  • Nazmul H. Rupok
    • The Incredible Code Injector

    Hi Hanna

    Hope you are doing great. Sorry that we missed the information from the chat history hence this lockout issue. However this lockout could happen for various reason and here one of my colleague Luís explained this well - https://premium.wpmudev.org/forums/topic/there-just-1#post-1232758

    You can do the mentioned steps to get rid of this or disable the lockout feature for now if you think it's costing you.

    Let me know if I could help further from our end. I'll be happy to do that.

    Have a nice day. Cheers!
    Nazmul

  • Hanna
    • New Recruit

    Did you actually have a look at the log? The link that you sent is not the same as my issue to start with.
    As I previously stated, you can clearly see when it's and invalid login attempt. These are all 404 errors. Why would I receive notification about 20 404 errors every day from legitimate customers and bots? How are these links even been created in the first place to receive the 404 errors? I'm not doing anything to the website (deleting and uploading products or pages) to produce the error message so where is coming from?
    I don't think it's costing me, I know it is as I had to unban a client. How many other clients are being banned?

  • Nazmul H. Rupok
    • The Incredible Code Injector

    Hi Hanna

    Hope you are doing well. Sorry to hear that you are frustrated with this. I thought the explanation would help but I also admit that seeing the 404 on log doesn't make sense while they are not really 404. I'll forward this to our developer so that they can assess this and improve the feature if there any issue. For now, you can disable IP Lockout feature if you want. I'll follow up when I get some explanation from our developer on this.

    Thanks for your patience on this.

    Have a nice day. Cheers!
    Nazmul

  • Predrag Dubajic
    • Support

    Hi Hanna,

    Thanks for the access, I had a look at your site and checked the logs but I'm afraid that there's not much we can do here, Defender listens to WP for 404 events and there's something causing these missing URL's on your site.
    Looks like there are some leftovers from theme/plugins and there also seem to be some bad URL's created by bad ajax, like this one for example:
    /product-category/manufacturer/free-spirit-westminster/all-free-spirit/page/11/www.frixxxxxxxxabric.com.au/product-category/manufacturer/www.frixxxxxxxxabric.com.au/product-category/new-arrivals/?product_count=24&product_view=grid&product_orderby=date

    I would suggest to turn off 404 blocking for now and get in touch with the theme/plugin devs responsible for these missing URL's and once those are sorted out you can re-enable 404 blocking.

    Best regards,
    Predrag

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.