systemd: Started Session *** of user root

admin

系统message日志无故报 systemd: Started Session :
Oct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
Oct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
, ^# k0 Z( L/ v) _3 \  ^% AOct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
3 D: R3 s& M5 }1 \( rOct 20 09:12:29 controller2 systemd: Started Session 111 of user root.
^C
) ~) b' x$ B( @5 |$ L! p6 N[root@controller2 ~]#
; w( n2 h7 W3 ]
5 W; O8 z! ~3 M! y) b解决办法：添加syslog配置
[root@controller2 ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
( M  k' g7 E% N0 \1 _2 ]2 e- |9 z[root@controller2 ~]#  
[root@controller2 ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
9 n/ S0 O8 e  t, Z. ]1 |
& K2 e2 H' J5 d5 w1 M. g
[root@controller2 ~]# tail -f /var/log/messages
& ?6 m& c* M& i9 ?Oct 20 08:10:01 controller2 systemd: Started Session 102 of user root.
Oct 20 08:20:01 controller2 systemd: Started Session 103 of user root.
# R9 k. d" ^: ]) F# I$ G& |* K( U4 qOct 20 08:30:01 controller2 systemd: Started Session 104 of user root.
" B0 {8 h0 K! S1 f2 o+ f& oOct 20 08:40:01 controller2 systemd: Started Session 105 of user root.
& s. b& v) s- y0 cOct 20 08:50:01 controller2 systemd: Started Session 106 of user root.
: X6 P& [; X6 @* OOct 20 09:00:01 controller2 systemd: Started Session 107 of user root.
4 j9 s) _; C5 @# x& {5 r; a' cOct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
  n5 K* |5 o' _# C4 {9 OOct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
Oct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
Oct 20 09:12:29 controller2 systemd: Started Session 111 of user root.


重启syslog
^C
[root@controller2 ~]# systemctl restart rsyslog
' C: x, S( G& C# q. Q; h
; L) M2 M1 d+ V9 L5 Z/ t" P
[root@controller2 ~]# tail -f /var/log/messages
) a1 W1 y2 i. _1 J9 xOct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
2 o, H' l) s1 G5 FOct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
Oct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
1 u0 P, A* f# x' N6 }Oct 20 09:12:29 controller2 systemd: Started Session 111 of user root.
Oct 20 09:15:11 controller2 systemd: Stopping System Logging Service...
7 Z' R# G/ K3 L/ F  a/ gOct 20 09:15:11 controller2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-55.el7" x-pid="1072" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 20 09:15:11 controller2 systemd: Stopped System Logging Service.
Oct 20 09:15:11 controller2 systemd: Starting System Logging Service...
Oct 20 09:15:11 controller2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-55.el7" x-pid="221370" x-info="http://www.rsyslog.com"] start
  Q+ F- l; |' E. \4 d# zOct 20 09:15:11 controller2 systemd: Started System Logging Service.
& ]3 [9 k6 O- g% X* P% k3 H; q) w
  q3 {+ f1 F  l! ~$ v0 p1 K8 s! U暂未报错：
* F0 y! ?; g) P1 A# j8 g

admin

  手动修改配置文件：
2 b# G: b6 s5 W) k/ c9 y0 D6 v; ^
将/etc/systemd/system.conf 中 LogLevel=info 设置成如下：
+ w3 X2 z/ X) N1 Q( }* ?7 C& j
#LogLevel=info
" Q; ]+ X2 V' V- X, C2 hLogLevel=notice

方法三：
通过系统命令，修改日志配置文件：
2 ^$ U: E' H2 x0 ^9 x! W- G9 n/ b7 Csystemd-analyze set-log-level notice

三、Linux服务器的日志管理
  o/ O9 }  _& Y% u消息紧急程度排行：
) z( A3 P, T9 e: B7 kemerg:该系统不可用
alert：需要立即修改
8 t& E+ g2 z8 }crit：紧急情况
/ \* E3 v6 n& xerr：错误信息
warning：预警信息
$ y$ P/ {/ v6 {8 ?4 A/ v: Rnotice：具有重要性的普通条件
/ M- Z* R6 b9 W- A9 G% finfo：提供信息的消息
9 n. K) L/ `3 B8 f; Pdebug：不包含函数条件或问题的其他信息
none：没有重要级，通常用于排错
9 E' X" c% R% m9 x9 W