1

My /var/log/messages file gets flooded every minute with the following messages: 

Dec 15 13:55:01 www systemd: Started Session 31 of user root.
Dec 15 13:55:01 www systemd: Starting Session 31 of user root.
Dec 15 13:55:01 www systemd: Removed slice User Slice of root.
Dec 15 13:55:01 www systemd: Stopping User Slice of root.

What do these messages mean? Is there a problem with the server? Is there a way to stop them from flooding the log?

Nemdr
  • 11
  • 1
  • 3
  • Does it correlate with a root-owned cron job? – Jeff Schaller Dec 15 '18 at 13:53
  • @JeffSchaller yes, I have a cron job configured to run every minute. I have changed the schedule of that job and now the messages appear less often, at the same time the cron job runs. I guess it's normal behavior. – Nemdr Dec 15 '18 at 14:29

1 Answers1

1

This is relatively common on systemd based machines. Events like this may happen when users login, cron jobs run, at jobs...

If you are running rsyslogd then it's possible to create a filter that drops these messages.

e.g. on RedHat (CentOS, etc), it's documented: https://access.redhat.com/solutions/1564823

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

systemctl restart rsyslog

This will prevent local logging of these events:

"Starting Session"
"Started Session"
"Created slice"
"Starting user-"
"Starting User Slice of"
"Removed session"
"Removed slice User Slice of"
"Stopping User Slice of"

You can adjust the filter to your needs.

Stephen Harris
  • 42,369
  • 5
  • 94
  • 123
  • Very good to know! In my case it was a cron job that was running every minute, I have changed its schedule. Now these messages are logged less often in `/var/log/messages`. – Nemdr Dec 15 '18 at 14:32