0

I want to unload the modules "gsch and redirfs" from kernel on RHEL 7.2 , which is causing frequent kernel panic.

But when I try to unload , I am getting below error.

# modprobe -r gsch
modprobe: FATAL: Module gsch is in use.

# modprobe -r redirfs
modprobe: FATAL: Module redirfs is in use.

# lsmod | grep gsch
gsch                   88591  4
redirfs                79430  1 gsch

As checked , no processes holding these modules,

# ps -ef | grep gsch
root     26417  7838  0 10:58 pts/3    00:00:00 grep --color=auto gsch
# lsof | grep gsch
#
Improve this question
5
  • 1
    Your modules are being used. The third column in lsmod is the number of processes using the modules. You will not see modules as processes in ps -ef or as files in lsof because modules are compiled kernel code, and not files or processes by themselves. The module code gets loaded into memory when needed by a process, and you need to know what the module does to identify which process might have loaded it.
    – Munir
    Jun 29, 2016 at 15:16
  • See stackoverflow.com/questions/9029526/… and the question linked in it for further help. dmesg is probably your best bet at figuring out what caused the module to load.
    – Munir
    Jun 29, 2016 at 15:18
  • As per the given link , I have checked dmesg command and found that service systemd-logind is holding the gsch module. But I couldn't stop the service becoz whenever I stop its again starting automatically. kindly advise.
    – Vathinth
    Jun 29, 2016 at 16:51
  • You can't stop systemd-logind because that services manages the user logins of your system. You'll break the entire system if you try to disable that. A quick google search shows that gsch and redirfs modules are RHEL proprietary modules and to get info about them you need a RHEL subscription. If you have a subscription, the best approach would be to contact RHEL support for this issue. If not, you should wait for someone here who knows about RHEL to answer here.
    – Munir
    Jun 29, 2016 at 17:35
  • Munir - But as checked with Red-hat , they are saying these modules are third party module and they will not take any responsibility for this... Lets see anyone coming for this...
    – Vathinth
    Jun 29, 2016 at 17:47

2 Answers 2

Reset to default
1

These modules are for real-time file access of the Antivirus software. Judging from the name "Trend Deep Security Agent" Trend Micro Antivirus, but it could another.

Improve this answer
0
0

These are modules from Trend Deep Security Agent:

# locate gsch
/opt/ds_agent/2.6.32-431.el6.x86_64/gsch.ko
/opt/ds_agent/2.6.32-431.el6.x86_64/gsch.ko.version
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/gsch.ko
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/gsch.ko.version

# locate redirfs
/opt/ds_agent/2.6.32-431.el6.x86_64/redirfs.ko
/opt/ds_agent/2.6.32-642.3.1.el6.x86_64/redirfs.ko
Improve this answer
1
  • That is, the ds_agent needs to be stopped first before unloading the modules, yes?
    – HalosGhost
    Aug 22, 2016 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .