10:01:01 compute01 systemd: Started Session 3217 of user root.

admin

10:01:01 compute01 systemd: Started Session 3217 of user root.
Resolution
These messages are normal and expected -- they will be seen any time a user logs in
To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
: J" r& ]  B& c7 m
Then restart the rsyslog service
  c: N- [* F4 t- H/ F3 }# u# ~, U* rsystemctl restart rsyslog
8 e* p& r) P8 b0 d6 {: U! k, E

# z0 R7 u7 n1 F. R7 j
+ o7 ^; `. V) ACentOS 7
系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示
3 m9 P- `8 W# B[root@centos ~]# cat /var/log/messages
) c6 X/ f! p$ x* \* |0 d+ s/ x8 uJul 30 08:01:01 centos systemd: Started Session 235 of user root.
; K; \5 V, M7 f/ x1 XJul 30 08:01:01 centos systemd: Starting Session 235 of user root.
/ I% u# {% X) e' H( h5 R; mJul 30 08:10:01 centos systemd: Started Session 236 of user root.
( T$ u* ~! `  H6 w( j0 dJul 30 08:10:01 centos systemd: Starting Session 236 of user root.
Jul 30 08:20:01 centos systemd: Started Session 237 of user root.
, b# y+ n( m8 T: mJul 30 08:20:01 centos systemd: Starting Session 237 of user root.
Jul 30 08:30:01 centos systemd: Started Session 238 of user root.
% R; H4 ~: o- [8 _8 {Jul 30 08:30:01 centos systemd: Starting Session 238 of user root.
9 }' x2 _, f! g: B. E% KJul 30 08:40:01 centos systemd: Started Session 239 of user root.
Jul 30 08:40:01 centos systemd: Starting Session 239 of user root.
3 l8 E* N4 Z4 v! r1 N1 {; i$ |  OJul 30 08:50:01 centos systemd: Started Session 240 of user root.
" y' _& s2 |+ PJul 30 08:50:01 centos systemd: Starting Session 240 of user root.
6 |; ]9 e* f0 u% T+ l这似乎是某个计划任务产生的日志
* |. `! z: f( ]0 P! N3 D[root@centos ~]# find / -name "cron.d"
  J; C0 u* ]/ ~! `/etc/cron.d
[root@centos ~]# ll /etc/cron.d/
total 8
-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly
8 Z( e  M' ^$ J5 I8 v) ~( ?# E-rw-------. 1 root root 235 Apr 11 11:33 sysstat
[root@centos ~]# cat /etc/cron.d/sysstat
# v- [5 E2 C; v$ r# A/ l# Run system activity accounting tool every 10 minutes
7 A5 w! j9 B! a- M6 y" F2 k*/10 * * * * root /usr/lib64/sa/sa1 1 1
) Q) U0 C/ n/ |3 u0 ]6 A# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
  T6 a6 i' e; ^7 G53 23 * * * root /usr/lib64/sa/sa2 -A
# V+ d! R: r- F: J. t
8 ~& E! K; ~- \4 E0 z! R6 d. P[root@compute01 ~]#  cat /etc/cron.d/sysstat
cat: /etc/cron.d/sysstat: No such file or directory
; _0 ?; v: ?7 y' ~4 W
红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下
2 D! c: y' }1 R: x* l) z4 L7 k% H[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
  E& Z0 z4 T8 g& e[root@centos ~]# systemctl restart rsyslog
4 I& W7 E! {7 o& R! b$ U; N
8 |% ]5 Q1 J: L) D
% U$ o. t& \: O4 X