UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and juno) as the Linux/RST.B virus. Not sure if it is accurate in saying that but since the machine is a development server I'm going to re-build to be safe.


I am using a Red Hat server and am getting the following errors every minute in the messages file:

Dec  1 16:50:01 ocalhost kernel: sshd:[4981]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb901ec error 6
Dec  1 16:51:01 ocalhost kernel: sshd:[4990]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffce4b3c error 6
Dec  1 16:52:01 ocalhost kernel: sshd:[5000]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb7f9dc error 6
Dec  1 16:53:01 ocalhost kernel: sshd:[5010]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000fff08d5c error 6
Dec  1 16:54:01 ocalhost kernel: sshd:[5022]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffaf194c error 6

I've had a look in the SSH log file and it doesn't show any errors (not even those above). Can anyone tell me what an 'error 6' is or shed any light on why this may be happening. If anyone can suggest anywhere else I can look for more clues that would be great, I seem to have reached a dead end on this one.

Further to the comments below, here is the start function from the /etc/init.d/sshd file:

        # Create keys if necessary
        if [ "x${AUTOCREATE_SERVER_KEYS}" != xNO ]; then

        cp -af /etc/localtime /var/empty/sshd/etc

        echo -n $"Starting $prog: "
        $SSHD $OPTIONS && success || failure
        [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd

Thanks C


Can you tell me if hpsmh is installed and running?

rpm -q hpsmh; [ -f "/opt/hp/hpsmh/logs/httpd.pid" ] && echo "running" || echo "not running"

Also, if hpsmh is installed, what are the permissions on its install root?

  • Thanks. hpsmh is not running. I've done a whereis and can't find hpsmh. – columbo Dec 1 '10 at 17:29
  • @columbo - can you please execute a `find / -type f -name 'libssl.so.*'? – Tok Dec 1 '10 at 17:36
  • Thanks for your reply....the result of the find is /lib/libssl.so.0.9.8b & /lib64/libssl.so.0.9.8b – columbo Dec 2 '10 at 9:02
  • Some more info... I installed atop and from atop's data I can see that the number of sshd processes running is increasing by 1 a minute. So, it would seem, each of these errors is causing a new sshd instance to start. This in turn is gradually sapping the RAM until it crashes the server. – columbo Dec 2 '10 at 9:52
  • Found this occuring every minute in the cron log /var/tmp/vi.recover/update >/dev/null 2>&1. Happens at 1 second past every minute the same as the SSHD errors... – columbo Dec 2 '10 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.