linux系统日志中出现大量systemd Starting Session ### of user root 解决

最新推荐文章于 2025-06-03 09:00:41 发布

weixin_30346033

最新推荐文章于 2025-06-03 09:00:41 发布

阅读量2.4w

点赞数

CC 4.0 BY-SA版权

文章标签：操作系统运维 git

原文链接：http://www.cnblogs.com/wyzhou/p/9803148.html

本文解析了在Red Hat Enterprise Linux 7中常见的系统日志消息，如Created slice user-0.slice.和Starting Session等，确认这些为正常现象，并提供了通过rsyslog配置来抑制此类日志输出的方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

这种情况是正常的，不算是一个问题

https://access.redhat.com/solutions/1564823

Environment

Red Hat Enterprise Linux 7

Issue

On my RHEL7 newely installed system I am seeing the following in /var/log/messages all the time

Jul 24 08:50:01 example.com systemd: Created slice user-0.slice.
Jul 24 08:50:01 example.com systemd: Starting Session 150 of user root.
Jul 24 08:50:01 example.com systemd: Started Session 150 of user root.
Jul 24 09:00:01 example.com systemd: Created slice user-0.slice.
Jul 24 09:00:02 example.com systemd: Starting Session 151 of user root.
Jul 24 09:00:02 example.com systemd: Started Session 151 of user root.

Resolution

These messages are normal and expected -- they will be seen any time a user logs in

To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

Then restart the rsyslog service