Unknown HZ value! (##) Assume 100 -- You've been hacked!

On RHEL or Centos 4 or 5, If you run the linux command top and you see something like:

"Unknown HZ value! (75) Assume 100"

Yours might not say "75" -- it could be any number.
If you see this, you should run rkhunter immediately, because your box has probably been taken over by a rootkit -- either SHV4 or SHV5.

The only reason you see this clue "Unknown HZ value" is because the rootkit replaces the top command (among others) with a substitute top command that will hide its processes. Their replacement top is old (version 1.2) and cannot handle the HZ value of the 2.6 linux kernel.
Sad to say, but if this happens to you, its time to reinstall your OS!

只翻译一句，哈哈，你被***了。

HZ defined how many ticks the internal timer interrupt in 1sec, which means the number of jiffies count in 1 sec.

Different architecture/machine may have different HZ value, you can check using this script from the timer interrupt:

#!/bin/sh
while [ 1 ]; do
A=`cat /proc/interrupts | grep timer | cut -d ‘:’ -f 2 |sed -e ‘s/[^0-9]//g’`
sleep 1
B=`cat /proc/interrupts | grep timer | cut -d ‘:’ -f 2 |sed -e ‘s/[^0-9]//g’`
C=$(($B-$A));
echo “HZ:$C”
done

it is around 250 in my desktop running 2.6, but 100 in my mips 2.4 embedded board.

Sometimes we may need to know the time in seconds from jiffies in kernel.

time(sec) = jiffies/HZ;

#!/bin/sh
while [ 1 ]; do
A=`cat /proc/interrupts | grep timer | awk ‘{ print $2 }’`
sleep 1
B=`cat /proc/interrupts | grep timer | awk ‘{ print $2 }’`
C=$(($B-$A));
echo “HZ:$C”
done