![systemd-logind 日志中的垃圾邮件](https://linux22.com/image/683971/systemd-logind%20%E6%97%A5%E5%BF%97%E4%B8%AD%E7%9A%84%E5%9E%83%E5%9C%BE%E9%82%AE%E4%BB%B6.png)
出现/var/log/auth.log
太多消息Removed session
Jun 2 17:42:39 srv-1 systemd-logind[13785]: Removed session c36006.
Jun 2 17:42:39 srv-1 systemd-logind[13785]: Removed session c36007.
Jun 2 17:42:40 srv-1 systemd-logind[13785]: Removed session c36008.
Jun 2 17:42:41 srv-1 systemd-logind[13785]: Removed session c36009.
Jun 2 17:42:41 srv-1 systemd-logind[13785]: Removed session c36010.
Jun 2 17:42:41 srv-1 systemd-logind[13785]: Removed session c36011.
Jun 2 17:42:42 srv-1 systemd-logind[13785]: Removed session c36012.
Jun 2 17:42:43 srv-1 systemd-logind[13785]: Removed session c36013.
Jun 2 17:42:43 srv-1 systemd-logind[13785]: Removed session c36014.
Jun 2 17:42:43 srv-1 systemd-logind[13785]: Removed session c36015.
Jun 2 17:42:44 srv-1 systemd-logind[13785]: Removed session c36016.
Jun 2 17:42:45 srv-1 systemd-logind[13785]: Removed session c36017.
Jun 2 17:42:45 srv-1 systemd-logind[13785]: Removed session c36018.
Jun 2 17:42:46 srv-1 systemd-logind[13785]: Removed session c36019.
Jun 2 17:42:47 srv-1 systemd-logind[13785]: Removed session c36020.
Jun 2 17:42:48 srv-1 systemd-logind[13785]: Removed session c36021.
并且没有关于新会话的消息,我不明白是什么导致了这个问题
uname -a
Linux backup-01 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.4 LTS
Release: 14.04
Codename: trusty
答案1
echo 'if ($programname == "systemd" or $programname == "systemd-logind")'\
' and ($msg contains "Starting Session" or $msg contains "Started Session"'\
' or $msg contains "Created slice" or $msg contains "Starting user-"'\
' or $msg contains "New session" or $msg contains "Removed session")'\
' then stop'>/etc/rsyslog.d/ignore-systemd-session.conf
systemctl restart rsyslog
在控制台中运行它以创建一个包含阻止垃圾邮件设置的文件
答案2
我发现,它是由service zabbix-agent start
命令引起的,如果我通过任何类似的命令启动 zabbix 代理,/etc/init.d/zabbix-agent start
则不会发生任何类似情况。