[SOLVED] "systemd: Started Session ### of user root" in /var/log/messages

thealmightyos · 08-22-2014, 04:06 PM

My server recently had a major issue (mem and swap were maxed) and I was tracking it in the log and noticed theses lines everywhere:

Code:

Aug 22 01:40:02 servername systemd: Started Session 431 of user root.

I was asleep at 1:40 last night so that wasn't me. Tell me that is just a system service doing what it's supposed to do.

TobiSGD · 08-22-2014, 04:17 PM

Do you by any chance have cron-jobs (or a systemd timer) set up to run at that time?

thealmightyos · 08-22-2014, 09:23 PM

Quote:

Originally Posted by TobiSGD

Do you by any chance have cron-jobs (or a systemd timer) set up to run at that time?

Not that I knew of.

But after reading your post I went and read all the *cron* files in etc. This is what I found:

Code:

# cat ./cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

So that must be what is causing it cause it is showing up in the log every ten minutes.

Thanks. False alarm.

sampappachan_nyc · 09-12-2016, 02:01 PM

''echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-") then stop'>/etc/rsyslog.d/ignore-systemd-session-slice.conf''

systemctl restart rsyslog

ebmnetwork · 03-22-2017, 04:29 PM

It worked for me in Red Hat Enterprise Linux Server release 7.2 (Maipo)

Source: https://access.redhat.com/solutions/1564823

Code:

#Add Filter
echo 'if ($programname == "systemd-logind" or $programname == "systemd") and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Removed session" or $msg contains "New session" or $msg contains "Created slice" or $msg contains "Starting user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

#Restart Syslog
systemctl restart rsyslog