|
|
10:01:01 compute01 systemd: Started Session 3217 of user root.1 o7 K0 U8 u) J9 U- ]- x4 e% A E M7 {
Resolution. w! k6 E- K' U* j+ h% J
These messages are normal and expected -- they will be seen any time a user logs in
7 _5 T1 f, c2 [1 X* H7 ZTo suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:5 P4 r1 {0 B: [' ?5 r- k, l3 v
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf: ]9 I0 Y5 ^7 a9 q) b) o' G5 h' y/ R
! `& f4 u$ R1 r# k$ P3 hThen restart the rsyslog service) u: l& F1 A% ]
systemctl restart rsyslog E* ?6 R: ?5 e4 Y
0 w, y1 l) U, Q+ Q2 w4 X' b: h! u
( ]2 u, y2 b' E$ q7 V
0 G" e' G8 _+ E7 U2 ^3 A
CentOS 7& r' Y: o6 n' H+ D( H% W5 L
系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示
/ j) \$ V1 a9 X$ ?& t[root@centos ~]# cat /var/log/messages % c4 _. `! o+ _" ]- W
Jul 30 08:01:01 centos systemd: Started Session 235 of user root. 0 H }( |! a {5 [& Q
Jul 30 08:01:01 centos systemd: Starting Session 235 of user root.
! B j6 A8 o7 k7 P4 ?# B; v* dJul 30 08:10:01 centos systemd: Started Session 236 of user root.
" U1 ]" h3 R3 EJul 30 08:10:01 centos systemd: Starting Session 236 of user root. - y; |% ~% r2 e! v w. a* H# ]
Jul 30 08:20:01 centos systemd: Started Session 237 of user root. & w6 }& i, [, w
Jul 30 08:20:01 centos systemd: Starting Session 237 of user root.
/ Z+ C5 {' a3 iJul 30 08:30:01 centos systemd: Started Session 238 of user root. " H$ A" G% G+ q. x7 Z8 `/ a
Jul 30 08:30:01 centos systemd: Starting Session 238 of user root. 7 D# G# B/ B2 h! [0 y
Jul 30 08:40:01 centos systemd: Started Session 239 of user root. ' G8 U( h( X! U( ]+ E% o/ f" }6 N
Jul 30 08:40:01 centos systemd: Starting Session 239 of user root.
& B, |, f7 U! M5 A2 G$ l; PJul 30 08:50:01 centos systemd: Started Session 240 of user root. 7 v2 N( M- W j$ z
Jul 30 08:50:01 centos systemd: Starting Session 240 of user root.8 f$ V! f4 }/ N. B q
这似乎是某个计划任务产生的日志
O' c. F6 h& A5 d4 C( ^, G% \[root@centos ~]# find / -name "cron.d"+ a2 A( r/ h1 Z" v. k" M* g. Q
/etc/cron.d
/ L' ^7 G9 Z" \* n3 @! {0 \$ r1 r[root@centos ~]# ll /etc/cron.d/) }3 @5 X/ V* T6 S
total 8
8 n1 D" J9 A, o% s( @" y-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly3 z d/ C m2 O, `, n% P% l/ s6 l
-rw-------. 1 root root 235 Apr 11 11:33 sysstat3 Y' H# L, [* D5 O" j" W
[root@centos ~]# cat /etc/cron.d/sysstat
# Q5 i- {& i% B) b# Run system activity accounting tool every 10 minutes
6 @/ ^, O3 r; {*/10 * * * * root /usr/lib64/sa/sa1 1 10 |" X7 q" H( R$ `
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
0 @' g @4 m, E* d: R! d# Generate a daily summary of process accounting at 23:53
* T6 y$ {) P7 l/ R- T: t0 I k4 @53 23 * * * root /usr/lib64/sa/sa2 -A
1 P7 S9 U* k' S3 d$ i
3 @' x! [& o* z[root@compute01 ~]# cat /etc/cron.d/sysstat
$ R9 ~" L* u6 L- U# ~0 Scat: /etc/cron.d/sysstat: No such file or directory8 {( h3 c' e) }. A! L% d: _
5 \2 Y3 Y# B* |- M5 P8 [红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下- u7 ?0 l p, _# S |- P0 }9 I
[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf5 a3 }1 ?3 {, D5 |! Z) z+ B2 b# B- M
[root@centos ~]# systemctl restart rsyslog
! ?5 O+ n& Z, k1 D- \5 {, S% E& a" e O F4 h/ \
% U7 G3 Z% x5 g6 g6 ~- S; P. w- ] ~ |
|
发表于 2022-5-7 15:00:04