Hi

My server got automatically rebooted . While checking the message logs it was found the bellow error

Mar 20 02:06:02 vpp211 kernel: Unable to handle kernel NULL pointer dereference
at 0000000000000001 RIP:
The messages in the /var/log/messages file is given below

We are using


Linux 2.6.9-78.ELsmp #1 SMP Wed Jul 9 15:46:26 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux OS

Memory is 32 GB .


Mar 20 02:04:02 vpp211 crond(pam_unix)[25809]: session closed for user linus
Mar 20 02:05:01 vpp211 crond(pam_unix)[26141]: session opened for user linus by
(uid=0)
Mar 20 02:05:01 vpp211 crond(pam_unix)[26141]: session closed for user linus
Mar 20 02:06:01 vpp211 crond(pam_unix)[26467]: session opened for user linus by
(uid=0)
Mar 20 02:06:02 vpp211 kernel: Unable to handle kernel NULL pointer dereference
at 0000000000000001 RIP:
Mar 20 02:20:33 vpp211 syslogd 1.4.1: restart.Mar 20 02:20:33 vpp211 syslog: syslogd startup succeeded
Mar 20 02:20:33 vpp211 kernel: klogd 1.4.1, log source = /proc/kmsg started.
Mar 20 02:20:33 vpp211 kernel: Bootdata ok (command line is ro root=LABEL=/ hdd=
ide-scsi console=tty0 console=ttyS1,115200)
Mar 20 02:20:33 vpp211 kernel: Linux version 2.6.9-78.ELsmp (brewbuilder@ls20-bc
2-14.build.redhat.com) (gcc version 3.4.6 20060404 (Red Hat 3.4.6-10)) #1 SMP We
d Jul 9 15:46:26 EDT 2008
Mar 20 02:20:33 vpp211 kernel: BIOS-provided physical RAM map:
Mar 20 02:20:33 vpp211 kernel: BIOS-e820: 0000000000000000 - 000000000009ec00 (
usable)
Mar 20 02:20:33 vpp211 kernel: BIOS-e820: 000000000009ec00 - 00000000000a0000 (
reserved)
Mar 20 02:20:33 vpp211 kernel: BIOS-e820: 00000000000f0000 - 0000000000100000 (
reserved)
Mar 20 02:20:33 vpp211 kernel: BIOS-e820: 0000000000100000 - 00000000cfe54000 (
usable)
Mar 20 02:20:33 vpp211 kernel: BIOS-e820: 00000000cfe54000 - 00000000cfe5c000 (
ACPI data)


Can i get what this error messages indicates , and what is the root cause for this messages

I am not amazed, you're using kernel that's 3 years old, what did you expect?
Upgrade your kernel, your software. It's a pain, after not doing so for a long time(you should do it regularly), but not as painful as getting rooted and lose all data. Or anything else could possibly happen.
This can be an exploit bruteforce attempt, in order to gain root, or, maybe they failed after trying several public exploits and decided to push down the server with some of DoS exploits. Unlikely it's a random hardware or software failure, but kernel served you for so many years without probs, correct? And also rh kernels seem to be tested and stable. So it's likely a script kiddie trying to get into your system.
I'd suggest even more, that you back up all the data and reinstall system from scratch, that way you'll make sure crackers didn't stay on your system.

The error message tell you that the kernel is crashed and then go to reboot mode to recovery the issue.

0 members found this post helpful.