topic Re: Error In Linux Server in Operating System - Linux

Error In Linux Server

Renjus — Thu, 22 Jul 2010 05:27:51 GMT

Hi

In our external mail server of linux showing error continuously in the terminal

Error is given below

Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.

Please any one tell me wat is it?
why is comming?

Re: Error In Linux Server

Michal Kapalka (mikap) — Thu, 22 Jul 2010 06:01:57 GMT

hi,

check this examples :

http://plugcomputer.org/plugforum/index.php?topic=317.0

http://www.bigismore.com/web-server-security/unknown-hz-value-assume-100-youve-been-hacked/

on the internet there are lot of discussions about this error messages.

mikap

Re: Error In Linux Server

FLQ — Thu, 22 Jul 2010 09:32:58 GMT

Hi Tinu,

did you modify/recompile your kernel?

Re: Error In Linux Server

Renjus — Thu, 22 Jul 2010 09:56:31 GMT

I didnt modify Kernel...

Re: Error In Linux Server

Matti_Kurkela — Sat, 24 Jul 2010 09:48:14 GMT

Did you read Michal's links?

It might be a harmless bug... if your system is not up to date with patches, you should update it.

The other possibility is a lot more scary:
Your mail server may have been hacked.

When an intruder manages to enter a system, s/he often installs a "rootkit" - a set of modified versions of system components and utilities. The modifications allow the intruder to hide his/her actions from the system administrator.

Sometimes the intruder uses an old rootkit, which includes components that are too old for the target system. This can cause strange error messages: a message just like yours is a common result of SHV4 or SHV5 rootkits.

http://www.rootkit.nl/projects/rootkit_hunter.html

Rootkit Hunter is a tool that can often confirm if a rootkit is installed, and even identify the type of a root kit. But if the intruder is smart, s/he might have done some extra modifications after installing the rootkit. This is why the only way to be absolutely sure that all the intruder's modifications are removed is to completely re-install the OS.

MK