Question on /var/log/message

General support questions
vicrly
Posts: 2
Joined: 2015/12/06 03:46:38

Question on /var/log/message

Post by vicrly » 2015/12/06 03:59:37

system:centos 7 1503

/var/log/message
Dec 6 04:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 04:01:01 localhost systemd: Starting Session 63 of user root.
Dec 6 04:01:01 localhost systemd: Started Session 63 of user root.
Dec 6 05:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 05:01:01 localhost systemd: Starting Session 64 of user root.
Dec 6 05:01:01 localhost systemd: Started Session 64 of user root.
Dec 6 06:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 06:01:01 localhost systemd: Starting Session 65 of user root.
Dec 6 06:01:01 localhost systemd: Started Session 65 of user root.
Dec 6 07:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 07:01:01 localhost systemd: Starting Session 66 of user root.
Dec 6 07:01:01 localhost systemd: Started Session 66 of user root.
Dec 6 08:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 08:01:02 localhost systemd: Starting Session 67 of user root.
Dec 6 08:01:02 localhost systemd: Started Session 67 of user root.
Dec 6 09:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 09:01:01 localhost systemd: Starting Session 68 of user root.
Dec 6 09:01:01 localhost systemd: Started Session 68 of user root.
Dec 6 10:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 10:01:01 localhost systemd: Starting Session 69 of user root.
Dec 6 10:01:01 localhost systemd: Started Session 69 of user root.
Dec 6 11:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 11:01:01 localhost systemd: Starting Session 70 of user root.
Dec 6 11:01:01 localhost systemd: Started Session 70 of user root.
Dec 6 11:27:03 localhost systemd: Created slice user-1000.slice.
Dec 6 11:27:03 localhost systemd: Starting Session 71 of user vwu.
Dec 6 11:27:03 localhost systemd: Started Session 71 of user vwu.
what it's doing for ?

SamLee
Posts: 61
Joined: 2015/08/05 08:13:26
Location: ShenZhen China
Contact:

Re: Question on /var/log/message

Post by SamLee » 2015/12/07 09:43:36

Hi Vicrly,

Good day.
The log is printed by the function session_start_scope()of the systemd-208-20.el7_1.6.x86_64 in CentOS7 1503.
This function is used to create cgroup;

The function will be called when there a user login because the OS will need to create cgroup for the just login user (The user could a real user or an app which uses dbus messages to communicate with other users).
These log just shows the info when the cgroup is created by systemd, so normally, you might be able to just ignore these logs.

------------- Brief introduction for cgroup ------------
Cgroup - control groups, which are called by their shorter name cgroups in this guide. Cgroups allow you to allocate resources—such as CPU time, system memory, network bandwidth, or combinations of these resources—among user-defined groups of tasks (processes) running on a system.
----------------------------------------------------------------------------

------------- Brief introduction for dbus ---------------
D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a "single instance" application or daemon, and to launch applications and daemons on demand when their services are needed
----------------------------------------------------------------------------

Hopes it helps.

Regards,
Sam
Study More, work hard

giulix63
Posts: 1305
Joined: 2014/05/14 10:06:37
Location: CE(S)T
Contact:

Re: Question on /var/log/message

Post by giulix63 » 2015/12/07 13:25:56

Nothing to be worried about. Use lingering to get rid of those messages.
Root is evil: Do not use root (sudo) to run any of the commands specified in my posts unless explicitly indicated. Please, provide the necessary amount of context to understand your problem/question.

vicrly
Posts: 2
Joined: 2015/12/06 03:46:38

Re: Question on /var/log/message

Post by vicrly » 2015/12/11 03:37:39

Very detailed, thank SamLee's reply. Also thank giulix63.

I have to stop it. Log too much!

giulix63
Posts: 1305
Joined: 2014/05/14 10:06:37
Location: CE(S)T
Contact:

Re: Question on /var/log/message

Post by giulix63 » 2015/12/11 09:03:32

Applying lingering did not stop it?
Root is evil: Do not use root (sudo) to run any of the commands specified in my posts unless explicitly indicated. Please, provide the necessary amount of context to understand your problem/question.

gulikoza
Posts: 181
Joined: 2007/05/06 20:15:23

Re: Question on /var/log/message

Post by gulikoza » 2015/12/11 12:30:12

I just split off all systemd noise into separate log (put the following into /etc/rsyslog.d/10-systemd.conf):

Code: Select all

if $syslogtag startswith 'systemd' then {
    action(type="omfile" file="/var/log/systemd")
    if $syslogseverity > 1 then stop
}
Add a logrotate entry as well, if you use it :)

mntbighker
Posts: 38
Joined: 2014/11/05 02:00:11

Re: Question on /var/log/message

Post by mntbighker » 2016/06/22 19:19:05

gulikoza wrote:I just split off all systemd noise into separate log (put the following into /etc/rsyslog.d/10-systemd.conf):

Code: Select all

if $syslogtag startswith 'systemd' then {
    action(type="omfile" file="/var/log/systemd")
    if $syslogseverity > 1 then stop
}
Add a logrotate entry as well, if you use it :)
In the immortal words of James Doohan "That's the ticket laddie" :ugeek:

jimj
Posts: 72
Joined: 2014/10/01 05:34:57

Re: Question on /var/log/message

Post by jimj » 2016/12/21 15:31:00

RedHat has another solution to just discard these logs. Their solution at https://access.redhat.com/solutions/1564823 mostly worked, but the "removed" and "stopping" messages weren't filtered. Therefore I took their solution and added two more things to discard and came up with this:

Code: Select all

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed slice user-" or $msg contains "Stopping user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
After creating that file restart the rsyslog service:

Code: Select all

systemctl restart rsyslog

fishface
Posts: 20
Joined: 2016/08/02 15:47:42

Re: Question on /var/log/message

Post by fishface » 2018/02/08 16:02:20

Digging up an old thread, I have tried to suppress the following messages in the daemon.log using the filter below, but it complains there is an error, but I cannot see anything wrong with it.

I'm attempting to filter the out the following, syntax directly copied from the daemon.log

Stopping User Slice
Starting User Slice
Removed slice User Slice
Created slice User Slice
Starting Session
Started Session

So my ignore-systemd-session-slice.conf looks like this, a slightly modified version of the above.

Code: Select all

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice User Slice" or $msg contains "Starting User Slice" or $msg contains "Removed slice User Slice" or $msg contains "Stopping User Slice") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
And the error is

Code: Select all

error during parsing file /etc/rsyslog.d/ignore-systemd-session-slice.conf, on or before line 2: errors occured in file '/etc/rsyslog.d/ignore-systemd-session-slice.conf' around line 2

fishface
Posts: 20
Joined: 2016/08/02 15:47:42

Re: Question on /var/log/message

Post by fishface » 2018/02/08 16:05:57

OK, just seen this

Code: Select all

action 'echo' treated as ':omusrmsg:echo' - please use ':omusrmsg:echo' syntax instead,

Post Reply