0

I want to unload the modules "gsch and redirfs" from kernel on RHEL 7.2 , which is causing frequent kernel panic.

But when I try to unload , I am getting below error.

# modprobe -r gsch
modprobe: FATAL: Module gsch is in use.

# modprobe -r redirfs
modprobe: FATAL: Module redirfs is in use.

# lsmod | grep gsch
gsch                   88591  4
redirfs                79430  1 gsch

As checked , no processes holding these modules,

# ps -ef | grep gsch
root     26417  7838  0 10:58 pts/3    00:00:00 grep --color=auto gsch
# lsof | grep gsch
#
  • 1
    Your modules are being used. The third column in lsmod is the number of processes using the modules. You will not see modules as processes in ps -ef or as files in lsof because modules are compiled kernel code, and not files or processes by themselves. The module code gets loaded into memory when needed by a process, and you need to know what the module does to identify which process might have loaded it. – Munir Jun 29 '16 at 15:16
  • See stackoverflow.com/questions/9029526/… and the question linked in it for further help. dmesg is probably your best bet at figuring out what caused the module to load. – Munir Jun 29 '16 at 15:18
  • As per the given link , I have checked dmesg command and found that service systemd-logind is holding the gsch module. But I couldn't stop the service becoz whenever I stop its again starting automatically. kindly advise. – Vathinth Jun 29 '16 at 16:51
  • You can't stop systemd-logind because that services manages the user logins of your system. You'll break the entire system if you try to disable that. A quick google search shows that gsch and redirfs modules are RHEL proprietary modules and to get info about them you need a RHEL subscription. If you have a subscription, the best approach would be to contact RHEL support for this issue. If not, you should wait for someone here who knows about RHEL to answer here. – Munir Jun 29 '16 at 17:35
  • Munir - But as checked with Red-hat , they are saying these modules are third party module and they will not take any responsibility for this... Lets see anyone coming for this... – Vathinth Jun 29 '16 at 17:47
1

These modules are for real-time file access of the Antivirus software. Judging from the name "Trend Deep Security Agent" Trend Micro Antivirus, but it could another.

|improve this answer|||||
0

These are modules from Trend Deep Security Agent:

# locate gsch
/opt/ds_agent/2.6.32-431.el6.x86_64/gsch.ko
/opt/ds_agent/2.6.32-431.el6.x86_64/gsch.ko.version
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/gsch.ko
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/gsch.ko.version

# locate redirfs
/opt/ds_agent/2.6.32-431.el6.x86_64/redirfs.ko
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/redirfs.ko
|improve this answer|||||
  • That is, the ds_agent needs to be stopped first before unloading the modules, yes? – HalosGhost Aug 22 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.