10:01:01 compute01 systemd: Started Session 3217 of user root.

admin

10:01:01 compute01 systemd: Started Session 3217 of user root.
3 f/ x' f( x0 \+ D) _9 xResolution
; M+ X8 ^' e- b( @These messages are normal and expected -- they will be seen any time a user logs in
To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:
# _5 R# O( d: gecho 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
; D: H) _( T& o+ r0 \- i
Then restart the rsyslog service
$ d% O) J: m6 d* T+ @2 w, l, f) Asystemctl restart rsyslog
+ ^; A# H& L7 m
' y- ]3 x4 W% x4 b; h
7 |4 Z" J- r7 t6 M" w9 U: s
CentOS 7
) G! _, B3 V: p# D$ M! _系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示
" {2 P- h( C9 ^# V7 j% _# y[root@centos ~]# cat /var/log/messages
Jul 30 08:01:01 centos systemd: Started Session 235 of user root.
. @4 Q. u: A% P7 }/ ^6 c- vJul 30 08:01:01 centos systemd: Starting Session 235 of user root.
Jul 30 08:10:01 centos systemd: Started Session 236 of user root.
, M) q* k! X8 o8 S3 {- WJul 30 08:10:01 centos systemd: Starting Session 236 of user root.
Jul 30 08:20:01 centos systemd: Started Session 237 of user root.
Jul 30 08:20:01 centos systemd: Starting Session 237 of user root.
Jul 30 08:30:01 centos systemd: Started Session 238 of user root.
Jul 30 08:30:01 centos systemd: Starting Session 238 of user root.
Jul 30 08:40:01 centos systemd: Started Session 239 of user root.
- m( @; T& r1 N/ m8 YJul 30 08:40:01 centos systemd: Starting Session 239 of user root.
' Y; V6 ]! S- R7 b$ ?1 ^! Z. }Jul 30 08:50:01 centos systemd: Started Session 240 of user root.
Jul 30 08:50:01 centos systemd: Starting Session 240 of user root.
- h& t6 I6 F7 a/ N这似乎是某个计划任务产生的日志
/ R/ c2 T( N6 Z& e[root@centos ~]# find / -name "cron.d"
% {# N2 T; f( k4 f9 J( l5 f/etc/cron.d
[root@centos ~]# ll /etc/cron.d/
# H* S) ^( {) Q6 {4 ^: m" ?9 Jtotal 8
' M/ s8 p9 ~+ D' Q  |-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly
-rw-------. 1 root root 235 Apr 11 11:33 sysstat
3 j1 i5 S+ Y* P, |: A[root@centos ~]# cat /etc/cron.d/sysstat
( e3 E- I1 r. F1 H3 E# Run system activity accounting tool every 10 minutes
4 Y% m8 |  b# [+ X+ I9 O( u  z*/10 * * * * root /usr/lib64/sa/sa1 1 1
2 H7 M* M9 o0 I3 j3 a# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
. Z) ]" n. W# }7 L/ A4 r53 23 * * * root /usr/lib64/sa/sa2 -A

9 R2 I+ |/ d9 r8 C' L5 Q, Q[root@compute01 ~]#  cat /etc/cron.d/sysstat
cat: /etc/cron.d/sysstat: No such file or directory

* ^: o. F+ a! g9 w4 {红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下
[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
+ N4 B6 k& Y+ o8 \8 B0 ]4 y* S[root@centos ~]# systemctl restart rsyslog