{"id":729,"date":"2018-03-29T10:15:16","date_gmt":"2018-03-29T02:15:16","guid":{"rendered":"https:\/\/blog.jsjs.org\/?p=729"},"modified":"2018-03-29T10:15:16","modified_gmt":"2018-03-29T02:15:16","slug":"logs-flooded-with-systemd-messages-created-slice-amp-starting-session","status":"publish","type":"post","link":"https:\/\/blog.jsjs.org\/?p=729","title":{"rendered":"Logs flooded with systemd messages: Created slice &amp;amp; Starting Session"},"content":{"rendered":"<p>https:\/\/access.redhat.com\/solutions\/1564823<\/p>\n<section class=\"field_kcs_environment_txt\">\n<h2>Environment<\/h2>\n<ul>\n<li>Red Hat Enterprise Linux 7<\/li>\n<\/ul>\n<\/section>\n<section class=\"field_kcs_issue_txt\">\n<h2>Issue<\/h2>\n<ul>\n<li>On my RHEL7 newely installed system I am seeing the following in\u00a0<code>\/var\/log\/messages<\/code>\u00a0all the time\n<div class=\"code-raw\">\n<div class=\"code-raw-toolbar\"><a class=\"code-raw-btn\" href=\"https:\/\/access.redhat.com\/solutions\/1564823#\">Raw<\/a><\/div>\n<pre><code>Jul 24 08:50:01 example.com systemd: Created slice user-0.slice.\nJul 24 08:50:01 example.com systemd: Starting Session 150 of user root.\nJul 24 08:50:01 example.com systemd: Started Session 150 of user root.\nJul 24 09:00:01 example.com systemd: Created slice user-0.slice.\nJul 24 09:00:02 example.com systemd: Starting Session 151 of user root.\nJul 24 09:00:02 example.com systemd: Started Session 151 of user root.\n<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<\/section>\n<section class=\"field_kcs_resolution_txt\">\n<h2>Resolution<\/h2>\n<ul>\n<li>These messages are normal and expected &#8212; they will be seen any time a user logs in<\/li>\n<li>To suppress these log entries in\u00a0<code>\/var\/log\/messages<\/code>, create a discard filter with rsyslog, e.g., run the following command:\n<div class=\"code-raw\">\n<div class=\"code-raw-toolbar\"><a class=\"code-raw-btn\" href=\"https:\/\/access.redhat.com\/solutions\/1564823#\">Raw<\/a><\/div>\n<pre><code>echo 'if $programname == \"systemd\" and ($msg contains \"Starting Session\" or $msg contains \"Started Session\" or $msg contains \"Created slice\" or $msg contains \"Starting user-\" or $msg contains \"Starting User Slice of\" or $msg contains \"Removed session\" or $msg contains \"Removed slice User Slice of\" or $msg contains \"Stopping User Slice of\") then stop' &gt;\/etc\/rsyslog.d\/ignore-systemd-session-slice.conf\n\n<\/code><\/pre>\n<\/div>\n<p>Then restart the rsyslog service<\/p>\n<div class=\"code-raw\">\n<div class=\"code-raw-toolbar\"><a class=\"code-raw-btn\" href=\"https:\/\/access.redhat.com\/solutions\/1564823#\">Raw<\/a><\/div>\n<pre><code>systemctl restart rsyslog\n<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<p><strong>Note<\/strong>\u00a0In case above rule only works for local syslog logging(\/var\/log\/messages) but doesn&#8217;t work for remote syslog server then we can understand this rule is read after syslog events are sent to syslog server. So in order to avoid this add the rule directly in rsyslog.conf above the line of remote syslog sending configuration. (<em>.<\/em>\u00a0@@sys-log server)<\/p>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>https:\/\/access.redhat.com\/solutions\/1564823 Environment Red Hat Enterprise Linux 7 Issue On my RHEL7 newely installed system I am seeing the following in\u00a0\/var\/log\/messages\u00a0all [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-729","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts\/729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=729"}],"version-history":[{"count":0,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=\/wp\/v2\/posts\/729\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.jsjs.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}