Error In Linux Server

[Renjus]

Hi

In our external mail server of linux showing error continuously in the terminal

Error is given below

Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.
Unknown HZ value! (121) Assume 100.



Please any one tell me wat is it?
why is comming?

[Michal Kapalka (mikap)]

hi,

check this examples :

http://plugcomputer.org/plugforum/index.php?topic=317.0

http://www.bigismore.com/web-server-security/unknown-hz-value-assume-100-youve-been-hacked/

on the internet there are lot of discussions about this error messages.

mikap

[FLQ]

Hi Tinu,

did you modify/recompile your kernel?

[Renjus]

I didnt modify Kernel...

[Matti_Kurkela]

Did you read Michal's links?

It might be a harmless bug... if your system is not up to date with patches, you should update it.

The other possibility is a lot more scary:
Your mail server may have been hacked.

When an intruder manages to enter a system, s/he often installs a "rootkit" - a set of modified versions of system components and utilities. The modifications allow the intruder to hide his/her actions from the system administrator.

Sometimes the intruder uses an old rootkit, which includes components that are too old for the target system. This can cause strange error messages: a message just like yours is a common result of SHV4 or SHV5 rootkits.

http://www.rootkit.nl/projects/rootkit_hunter.html

Rootkit Hunter is a tool that can often confirm if a rootkit is installed, and even identify the type of a root kit. But if the intruder is smart, s/he might have done some extra modifications after installing the rootkit. This is why the only way to be absolutely sure that all the intruder's modifications are removed is to completely re-install the OS.

MK