Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and juno) as the Linux/RST.B virus. Not sure if it is accurate in saying that but since the machine is a development server I'm going to re-build to be safe.

Hello,

I am using a Red Hat server and am getting the following errors every minute in the messages file:

Dec  1 16:50:01 ocalhost kernel: sshd:[4981]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb901ec error 6
Dec  1 16:51:01 ocalhost kernel: sshd:[4990]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffce4b3c error 6
Dec  1 16:52:01 ocalhost kernel: sshd:[5000]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb7f9dc error 6
Dec  1 16:53:01 ocalhost kernel: sshd:[5010]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000fff08d5c error 6
Dec  1 16:54:01 ocalhost kernel: sshd:[5022]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffaf194c error 6

I've had a look in the SSH log file and it doesn't show any errors (not even those above). Can anyone tell me what an 'error 6' is or shed any light on why this may be happening. If anyone can suggest anywhere else I can look for more clues that would be great, I seem to have reached a dead end on this one.

Further to the comments below, here is the start function from the /etc/init.d/sshd file:

start()
{
        # Create keys if necessary
        if [ "x${AUTOCREATE_SERVER_KEYS}" != xNO ]; then
                do_rsa1_keygen
                do_rsa_keygen
                do_dsa_keygen
        fi

        cp -af /etc/localtime /var/empty/sshd/etc

        echo -n $"Starting $prog: "
        $SSHD $OPTIONS && success || failure
        RETVAL=$?
        [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd
        echo
}

Thanks C

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

Can you tell me if hpsmh is installed and running?

rpm -q hpsmh; [ -f "/opt/hp/hpsmh/logs/httpd.pid" ] && echo "running" || echo "not running"

Also, if hpsmh is installed, what are the permissions on its install root?

share|improve this answer
    
Thanks. hpsmh is not running. I've done a whereis and can't find hpsmh. –  columbo Dec 1 '10 at 17:29
    
@columbo - can you please execute a `find / -type f -name 'libssl.so.*'? –  Tok Dec 1 '10 at 17:36
    
Thanks for your reply....the result of the find is /lib/libssl.so.0.9.8b & /lib64/libssl.so.0.9.8b –  columbo Dec 2 '10 at 9:02
    
Some more info... I installed atop and from atop's data I can see that the number of sshd processes running is increasing by 1 a minute. So, it would seem, each of these errors is causing a new sshd instance to start. This in turn is gradually sapping the RAM until it crashes the server. –  columbo Dec 2 '10 at 9:52
    
Found this occuring every minute in the cron log /var/tmp/vi.recover/update >/dev/null 2>&1. Happens at 1 second past every minute the same as the SSHD errors... –  columbo Dec 2 '10 at 11:06
show 22 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.