Question on /var/log/message

[vicrly]

system:centos 7 1503

/var/log/message

Dec 6 04:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 04:01:01 localhost systemd: Starting Session 63 of user root.
Dec 6 04:01:01 localhost systemd: Started Session 63 of user root.
Dec 6 05:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 05:01:01 localhost systemd: Starting Session 64 of user root.
Dec 6 05:01:01 localhost systemd: Started Session 64 of user root.
Dec 6 06:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 06:01:01 localhost systemd: Starting Session 65 of user root.
Dec 6 06:01:01 localhost systemd: Started Session 65 of user root.
Dec 6 07:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 07:01:01 localhost systemd: Starting Session 66 of user root.
Dec 6 07:01:01 localhost systemd: Started Session 66 of user root.
Dec 6 08:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 08:01:02 localhost systemd: Starting Session 67 of user root.
Dec 6 08:01:02 localhost systemd: Started Session 67 of user root.
Dec 6 09:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 09:01:01 localhost systemd: Starting Session 68 of user root.
Dec 6 09:01:01 localhost systemd: Started Session 68 of user root.
Dec 6 10:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 10:01:01 localhost systemd: Starting Session 69 of user root.
Dec 6 10:01:01 localhost systemd: Started Session 69 of user root.
Dec 6 11:01:01 localhost systemd: Created slice user-0.slice.
Dec 6 11:01:01 localhost systemd: Starting Session 70 of user root.
Dec 6 11:01:01 localhost systemd: Started Session 70 of user root.
Dec 6 11:27:03 localhost systemd: Created slice user-1000.slice.
Dec 6 11:27:03 localhost systemd: Starting Session 71 of user vwu.
Dec 6 11:27:03 localhost systemd: Started Session 71 of user vwu.

what it's doing for ?

[SamLee]

Hi Vicrly,

Good day.
The log is printed by the function session_start_scope()of the systemd-208-20.el7_1.6.x86_64 in CentOS7 1503.
This function is used to create cgroup;

The function will be called when there a user login because the OS will need to create cgroup for the just login user (The user could a real user or an app which uses dbus messages to communicate with other users).
These log just shows the info when the cgroup is created by systemd, so normally, you might be able to just ignore these logs.

------------- Brief introduction for cgroup ------------
Cgroup - control groups, which are called by their shorter name cgroups in this guide. Cgroups allow you to allocate resources—such as CPU time, system memory, network bandwidth, or combinations of these resources—among user-defined groups of tasks (processes) running on a system.
----------------------------------------------------------------------------

------------- Brief introduction for dbus ---------------
D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a "single instance" application or daemon, and to launch applications and daemons on demand when their services are needed
----------------------------------------------------------------------------

Hopes it helps.

Regards,
Sam

[giulix63]

Nothing to be worried about. Use lingering to get rid of those messages.

[vicrly]

Very detailed, thank SamLee's reply. Also thank giulix63.

I have to stop it. Log too much!

[giulix63]

Applying lingering did not stop it?

[gulikoza]

I just split off all systemd noise into separate log (put the following into /etc/rsyslog.d/10-systemd.conf):

Code: Select all

if $syslogtag startswith 'systemd' then {
    action(type="omfile" file="/var/log/systemd")
    if $syslogseverity > 1 then stop
}

Add a logrotate entry as well, if you use it

[mntbighker]

I just split off all systemd noise into separate log (put the following into /etc/rsyslog.d/10-systemd.conf):

Code: Select all

if $syslogtag startswith 'systemd' then {
    action(type="omfile" file="/var/log/systemd")
    if $syslogseverity > 1 then stop
}

Add a logrotate entry as well, if you use it

In the immortal words of James Doohan "That's the ticket laddie"

[jimj]

RedHat has another solution to just discard these logs. Their solution at https://access.redhat.com/solutions/1564823 mostly worked, but the "removed" and "stopping" messages weren't filtered. Therefore I took their solution and added two more things to discard and came up with this:

Code: Select all

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed slice user-" or $msg contains "Stopping user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

After creating that file restart the rsyslog service:

Code: Select all

systemctl restart rsyslog

[fishface]

Digging up an old thread, I have tried to suppress the following messages in the daemon.log using the filter below, but it complains there is an error, but I cannot see anything wrong with it.

I'm attempting to filter the out the following, syntax directly copied from the daemon.log

Stopping User Slice
Starting User Slice
Removed slice User Slice
Created slice User Slice
Starting Session
Started Session

So my ignore-systemd-session-slice.conf looks like this, a slightly modified version of the above.

Code: Select all

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice User Slice" or $msg contains "Starting User Slice" or $msg contains "Removed slice User Slice" or $msg contains "Stopping User Slice") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

And the error is

Code: Select all

error during parsing file /etc/rsyslog.d/ignore-systemd-session-slice.conf, on or before line 2: errors occured in file '/etc/rsyslog.d/ignore-systemd-session-slice.conf' around line 2

[fishface]

OK, just seen this

Code: Select all

action 'echo' treated as ':omusrmsg:echo' - please use ':omusrmsg:echo' syntax instead,