系统日志中充满了会话和切片消息


16

我安装了新的CentOS 7,并注意到我的/ var / log / messages文件中充满了这样的消息

Mar  6 08:40:01 myhostname systemd: Started Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Started Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Starting Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Started Session 2041 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2041 of user root.
Mar  6 08:40:31 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:40:31 myhostname systemd: Stopping user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Started Session 2044 of user userx.
Mar  6 08:41:01 myhostname systemd: Starting Session 2044 of user userx.
Mar  6 08:41:21 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:41:21 myhostname systemd: Stopping user-1001.slice.

这些都是什么意思,为什么它们在那里?如果这是正常的背景噪音,它们似乎是对资源的极大浪费,无法记录下来……

Answers:


19

(此问题也在超级用户那里得到了回答)

这些是与片的创建和删除有关的消息,这些消息在systemd中用于对进程进行分组并管理其资源。

为什么默认情况下会记录它们,这使我不解,但我已经看到了两种禁用它们的方法:

  1. 侵入性较小的方法是通过创建具有以下内容的/etc/rsyslog.d/ignore-systemd-session-slice.conf来过滤掉它们:

    if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed Slice" or $msg contains "Stopping user-") then stop
    

    然后重新启动rsyslogd systemctl restart rsyslog

  2. 更广泛的方法是通过编辑将systemd日志记录级别设置得更高一些/etc/systemd/system.conf

     #LogLevel=info
     LogLevel=notice
    

参考文献:


if $programname contains "systemd"由于声明了程序名称而不得不更改语句systemd-logind
Aidas

@Aidas,出于好奇,什么发行版/系统版本?
fusorx

1
CentOS Linux版本7.5.1804(核心)
Aidas,

2

这些消息是正常现象,是预期的-用户每次登录都可以看到这些消息

要在/ var / log / messages中禁止显示这些日志条目,请使用rsyslog创建一个丢弃过滤器,例如,运行以下命令:

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

然后重新启动rsyslog服务

systemctl restart rsyslog

https://access.redhat.com/solutions/1564823

By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.