☰

充满会话和切片消息的系统日志

tag-icon • tag-icon syslog
充满会话和切片消息的系统日志

我安装了新的 CentOS 7，并注意到我的 /var/log/messages 文件充满了这样的消息

Mar  6 08:40:01 myhostname systemd: Started Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Started Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Starting Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Started Session 2041 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2041 of user root.
Mar  6 08:40:31 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:40:31 myhostname systemd: Stopping user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Started Session 2044 of user userx.
Mar  6 08:41:01 myhostname systemd: Starting Session 2044 of user userx.
Mar  6 08:41:21 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:41:21 myhostname systemd: Stopping user-1001.slice.

所有这些意味着什么？它们为何存在？如果这是正常的背景噪音，那么记录这个似乎是对资源的巨大浪费......

答案1

（这个问题也在超级用户上得到了回答这里）

这些是与切片的创建和删除有关的消息，它们在 systemd 中用于对进程进行分组并管理其资源。

为什么默认情况下会记录它们，但我看到了两种禁用它们的方法：

  1. 侵入性较小的方法是通过创建包含以下内容的 /etc/rsyslog.d/ignore-systemd-session-slice.conf 来过滤掉它们：

    if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed Slice" or $msg contains "Stopping user-") then stop

    并重新启动 rsyslogdsystemctl restart rsyslog

  2. 更广泛的方法是通过编辑将 systemd 日志记录级别设置得更高一点/etc/systemd/system.conf：

     #LogLevel=info
 LogLevel=notice

参考：

答案2

这些消息是正常的且符合预期——用户每次登录时都会看到它们

要抑制 /var/log/messages 中的这些日志条目，请使用 rsyslog 创建丢弃过滤器，例如，运行以下命令：

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

然后重启rsyslog服务

systemctl restart rsyslog

https://access.redhat.com/solutions/1564823

相关内容