myDEBUG log files hit inode limit

After a lot of functionality on our client's website stopped working yesterday, we learned that the server hit the inode limit due to a huge number of log files being written to the /logs directory. They're all in the format myDEBUG-*.log, and contain basically the same message pasted below. The hosting provider deleted them, but there are hundreds of new ones being generated per minute.

Any ideas on what is causing these warnings? I assume something is being passed into the foreach that is not an array. Also, is there a way to disable writing log files on a PHP Warning severity level?

Zen Cart v1.5.5a

Thanks!

[27-Apr-2017 13:33:57 America/Phoenix] Request URI: /index.php?main_page=product_info&cPath=&products_id=555, IP address: XXXXXXXXXX
#1  base->attach() called at [/home/XXXXXXXX/public_html/includes/classes/observers/class.google_recaptcha.php:24]
#2  google_recaptcha->__construct() called at [/home/XXXXXXXX/public_html/includes/autoload_func.php:79]
#3  require(/home/XXXXXXXX/public_html/includes/autoload_func.php) called at [/home/XXXXXXXX/public_html/includes/application_top.php:170]
#4  require(/home/XXXXXXXX/public_html/includes/application_top.php) called at [/home/XXXXXXXX/public_html/index.php:26]

[27-Apr-2017 13:33:57 America/Phoenix] PHP Warning:  Invalid argument supplied for foreach() in /home/XXXXXXXX/public_html/includes/classes/class.base.php on line 30

Could be the site is under some sort of attack. I would disable the CAPTCHA to see if that helps. Check your Apache error log as well to see if that sheds any light on things.

If not, then I would suggest to put the site into Maintenance mode, then delete all error logs. Then see if new debug files are being generated by Search Engine Bots and if so, what exactly they are. You should then also do some testing yourself to see if you can duplicate the errors.

What are the contents of: includes/classes/observers/class.google_recaptcha.php?

As far as disabling all warning messages, yes you can, but it is not advisable per se. Instead that issue should be resolved.

Said that they were all pretty much the same, was/is it that everything from #2 and down has been the same or are different notifiers at play?

mc12345678:

What are the contents of: includes/classes/observers/class.google_recaptcha.php?

As far as disabling all warning messages, yes you can, but it is not advisable per se. Instead that issue should be resolved.

Said that they were all pretty much the same, was/is it that everything from #2 and down has been the same or are different notifiers at play?

Correct, everything from line 2 on down is the same except for the timestamps. There seems to be a wide variety of IP addresses, so it might be normal website traffic that is triggering something on every page hit. My previous estimate of "hundreds per minute" turned out to be a bit high.

Here are the contents of class.google_recaptcha.php - I believe we were having some trouble getting CAPTCHA working in v1.5.5, so I removed it from the pages. There might still be some hooks to it, though.

<?php
/**
*
* @package plugins
* @copyright Copyright 2003-2012 Zen Cart Development Team
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
*
* Designed for v1.5.4
* Observer class for Google reCaptcha
*/

class google_recaptcha extends base {
	/**
	 * @var array
	 */
	private $pages_to_checkcheck = array();

	function __construct() {

		//comment out any pages you do NOT want to check
		//$pages_to_check[] =  'NOTIFY_CONTACT_US_CAPTCHA_CHECK';
		//$pages_to_check[] =  'NOTIFY_CREATE_ACCOUNT_CAPTCHA_CHECK';
		//$pages_to_check[] =  'NOTIFY_REVIEWS_WRITE_CAPTCHA_CHECK';
		$this->attach($this,$pages_to_check);
	}

	function update(&$class, $eventID, $paramsArray = array()) {
		global $messageStack, $error, $privatekey;

		require_once __DIR__ . '/google/autoload.php';
		$recaptcha = new \ReCaptcha\ReCaptcha($privatekey);
		// If file_get_contents() is locked down on your PHP installation to disallow
		// its use with URLs, then you can use the alternative request method instead.
		// This makes use of fsockopen() instead.
		//$recaptcha = new \ReCaptcha\ReCaptcha($privatekey, new \ReCaptcha\RequestMethod\SocketPost());
		// This makes use of curl instead
		//$recaptcha = new \ReCaptcha\ReCaptcha($privatekey, new \ReCaptcha\RequestMethod\Curl());

		$resp = $recaptcha->verify($_POST['g-recaptcha-response'], $_SERVER['REMOTE_ADDR']);

		if (!$resp->isSuccess()) {
			$event_array = array('NOTIFY_CONTACT_US_CAPTCHA_CHECK' => 'contact', 'NOTIFY_CREATE_ACCOUNT_CAPTCHA_CHECK' => 'create_account', 'NOTIFY_REVIEWS_WRITE_CAPTCHA_CHECK' => 'review_text');
			$messageStack->add($event_array[$eventID], $resp->getErrors());
			$error = true;
		}
		return $error;
	}
}

So, while it appears that the instructions may have been followed about commenting out the pages on which it is not to be used, but the intention is that it would still be used otherwise all of the modifications made for the plugin to operate should be removed from the server. (generally speaking there should be removal/uninstall instructions or in a way reversing the installation process should do it as well.) Basically, another thing is that $pages_to_check was never initialized so with all occurrences commented out it isn't treated as a blank array which a foreach statement can handle.If the file is to remain on the server, may I suggest that the line before the first commented out page that the following be added?```
$pages_to_check = array();

mc12345678:

Suggestion is 1) to add the appropriate line from above to the file to stop the bleeding, then 2) seek out the proper way to remove the plugin if it is not to be used. Extra software leads to additional potential issues.

Thank you! The wound has been cauterized. No error log files for the past few minutes.

I had assumed that the line

private $pages_to_checkcheck = array();

just above the constructor would have initialized the array, but apparently it was in a different scope.

Anyway, I will continue with a full removal of the plugin. Thanks again.

d9000:

Thank you! The wound has been cauterized. No error log files for the past few minutes.

I had assumed that the line

private $pages_to_checkcheck = array();

just above the constructor would have initialized the array, but apparently it was in a different scope.

Anyway, I will continue with a full removal of the plugin. Thanks again.
It would have if everywhere else it was used that it was referenced as: $this->pages_to_check.

Glad that part of the surgery is complete. Good luck with the rest. Remember to backup frequently.