|
|
10:01:01 compute01 systemd: Started Session 3217 of user root.
' C9 }. a2 N V9 H4 P* R0 EResolution
9 f) {7 ~" \. s! l; O. ^% j- M" RThese messages are normal and expected -- they will be seen any time a user logs in4 ~# q9 g* [8 c# e
To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:# F8 ?+ b9 I! w) M- Z% [: z
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf5 J" K* H4 j5 d
0 f) f. a) p6 y* s4 R6 j* z
Then restart the rsyslog service6 o; F9 D/ S; n
systemctl restart rsyslog
' k* m3 X& M2 Q! Q
; ]' p v3 t/ A% e5 v/ Z$ g, }9 u w' ^% g( @
/ f8 R$ @# F4 F5 ]3 o3 qCentOS 71 T6 v4 X% n: w) l- z/ Z7 B8 U
系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示; Y7 i+ ?% n! \" D+ r
[root@centos ~]# cat /var/log/messages , ]2 d: G( J" ^+ Q& x+ [$ M
Jul 30 08:01:01 centos systemd: Started Session 235 of user root.
- ^, v# E1 K. o/ p0 {! i( E6 {Jul 30 08:01:01 centos systemd: Starting Session 235 of user root.
- o& D9 p' f& q4 l; ^7 FJul 30 08:10:01 centos systemd: Started Session 236 of user root. / T; B; M- A% D) i5 A. Z: a
Jul 30 08:10:01 centos systemd: Starting Session 236 of user root. $ P: s! Y$ M6 p- g1 G/ b
Jul 30 08:20:01 centos systemd: Started Session 237 of user root. / W; U" N( t% I+ X, H7 c
Jul 30 08:20:01 centos systemd: Starting Session 237 of user root. 2 H9 B% c, F1 F h, o1 N
Jul 30 08:30:01 centos systemd: Started Session 238 of user root. 2 o. g* I& t1 w6 d7 a
Jul 30 08:30:01 centos systemd: Starting Session 238 of user root.
6 }! N( h0 P3 qJul 30 08:40:01 centos systemd: Started Session 239 of user root.
! b. W* t z- p7 Q1 B8 MJul 30 08:40:01 centos systemd: Starting Session 239 of user root.
2 z% n" G8 S& Z& g. E2 LJul 30 08:50:01 centos systemd: Started Session 240 of user root.
w: G# T6 J9 R8 eJul 30 08:50:01 centos systemd: Starting Session 240 of user root.9 L- p( o" ]7 Q( X' R/ b
这似乎是某个计划任务产生的日志5 z- ^3 d3 K v* U) a4 W. z
[root@centos ~]# find / -name "cron.d"1 R9 D7 s1 l/ d- e* P
/etc/cron.d
$ _5 [5 @& Q+ M& r[root@centos ~]# ll /etc/cron.d/
; R+ Q7 X* S3 N1 R$ _+ btotal 8
# ^( ]: X8 M1 _-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly" x6 Q. t- w* D5 B+ j
-rw-------. 1 root root 235 Apr 11 11:33 sysstat
" H5 }3 X+ D h. i8 V0 F[root@centos ~]# cat /etc/cron.d/sysstat9 ~$ ^9 K* H& ^0 c5 h, G
# Run system activity accounting tool every 10 minutes" l0 |: y: ]+ x7 I/ h- H
*/10 * * * * root /usr/lib64/sa/sa1 1 1
1 x; O6 W$ o" f* `8 r9 f$ a# 0 * * * * root /usr/lib64/sa/sa1 600 6 &6 G, p( ]0 J" G1 N' {: y) n+ e
# Generate a daily summary of process accounting at 23:53
% q6 I1 a a; \53 23 * * * root /usr/lib64/sa/sa2 -A, `$ ~1 _ E6 w! C
) F6 C4 {$ g8 J4 ^9 o) R, i8 _
[root@compute01 ~]# cat /etc/cron.d/sysstat
) e3 Q9 {; d( S* w5 e1 I2 s. o" Ecat: /etc/cron.d/sysstat: No such file or directory9 l4 m3 m0 _0 d M, b; g
$ H S7 p4 M9 a6 w, ?: N* F红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下
5 A7 O# Z- m6 j: y1 J[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf% Q) l* O& r5 i: `* t+ M
[root@centos ~]# systemctl restart rsyslog! R, ?; ]$ q" @9 |2 f+ e
$ s$ K. y! a1 a
5 _8 O9 L& T, [: I0 c! ?4 o4 W |
|
发表于 2022-5-7 15:00:04