Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have serious problem when I loged in to my server (Centos5.2-Final) It announced that :

-bash: /bin/egrep: cannot execute binary file
-bash: /bin/egrep: cannot execute binary file
-bash: /bin/egrep: cannot execute binary file
-bash: /bin/hostname: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file

The apache and mysql running on this server is work fine but all the execute file in /bin folder have this problem, some of them cannot execute (vi, uname, ps...)

Have anyone met this problem! Please tell me how to solve it !

share|improve this question
what is the output from "which egrep" or "which hostname" or "which grep"? – Devin Ceartas Sep 21 '09 at 3:33
can you copy (assuming scp works) any of egrep/hostname to sane system and run "file" against them? – kolbusa Sep 21 '09 at 4:21
@Devin Ceartas : the ouput is : /bin/egrep /bin/grep /bin/hostname @kolbusa : I have only one server ! If I have another one exactly the same may be I'll try to copy the execute file form that server ? Is that possible ? – billyduc Sep 21 '09 at 4:39
up vote 0 down vote accepted

Can you please post the following...

ls -l /bin/hostname /bin/egrep /bin/hostname
ldd /bin/hostname /bin/egrep /bin/hostname
file /bin/hostname /bin/egrep /bin/hostname
ls -ld /bin/
echo $SHELL
share|improve this answer
here is my output ; #ls -l /bin/hostname /bin/egrep lrwxrwxrwx 1 root root 4 Jan 2 2008 /bin/egrep -> grep -rwxr-xr-x 1 root root 24200 Sep 20 00:47 /bin/hostname # ldd /bin/hostname /bin/egrep /bin/hostname: not a dynamic executable /bin/egrep: not a dynamic executable # file /bin/hostname /bin/egrep /bin/hostname: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), corrupted program header size, corrupted section header size /bin/egrep: symbolic link to `grep' – billyduc Sep 21 '09 at 7:30
I think @mitizhi is right : my centos5.2-final is running on Intel Dual Core x86_64 2GHz...but the out put of #file /bin/hostname is AMD x86-64 – billyduc Sep 21 '09 at 7:33
No, that's normal and to be expected. I don't recall the exact historical reasons, but it has something to do with the industry adopting AMD's variant of the 64 bit instruction set. – Insyte Sep 21 '09 at 17:46
"corrupted program header size" is not good. Did you copy the binaries across from another machine (of a different architecture) by any chance? My guess is not otherwise you'd have mentioned it. If you have another server with the save ARCH/Hardware profile, can you do an md5sum on these corrupted binaries and make sure that they're not identical. I think the safest way, if rpm still works, is to reinstall them if at all possible, you may need to copy over individual files from another server of the same arch/os to be able to to even that though. Interested to see how you go. – Xerxes Sep 22 '09 at 4:48
@Xerxes : thanks for your comment ... I copied the corrupted file from another server with the same arch& hardware via scp and now it's work fine ^^ . Now I'm performing an update entire my server ! – billyduc Sep 22 '09 at 14:53

What is your output of: grep SELINUX /etc/sysconfig/selinux

Chances are SELinux is blocking access.

share|improve this answer

That is a rootkit ... usualy some rootkits do not require to be compiled. All the files are just replaced . When you are using some i686 Linux those rootkits are installed and anything works perfect but on x86_64 machines you get those errors. You can check /usr/lib/libsh . If this folder is present you have rootkit called shv(4-5) and you will find a folder called backup. In that folder you will find your files like : egrep/hostname/uname/etc. Just copy them and replace /bin files or you can just test them like this : ./hostname . You can reinstall your binutils with yum or get .rpm file and install it manualy. Remember to make backups if you are going to replace manualy.

share|improve this answer

That error's supposed to be shown for shell scripts without a shebang, so I'm not sure why it'd be shown for those files. I'm wondering if the dynamic linker's gone away, or if the files have been corrupted somehow and they're now full of something else. What does file say they are?

share|improve this answer
file say corrupted program header size, corrupted section header size – billyduc Sep 21 '09 at 7:38
Your machine is stuffed. Thoroughly test all the hardware, and then reinstall. – womble Sep 21 '09 at 8:59
Smells like a rootkit. – Tom O'Connor Dec 3 '10 at 12:25

The bad scenario I can think of is that the files in /bin directory have been corrupted. Another scenario is that the architecture of the ELF files do not match your platform architecture; this could happen if you have x86_64 (64-bit) system but boot with i386 (32-bit) kernel that is incapable of running x86_64 executables.

  1. What is the output of executing "file /bin/grep"
  2. What is the output of "uname -a"
share|improve this answer
# file /bin/grep /bin/grep: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), corrupted program header size, corrupted section header size # uname -a -bash: /bin/uname: cannot execute binary file – billyduc Sep 21 '09 at 7:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.