10:01:01 compute01 systemd: Started Session 3217 of user root.

admin

10:01:01 compute01 systemd: Started Session 3217 of user root.
% h* H2 Y0 m5 y, ~+ Y3 s+ DResolution
These messages are normal and expected -- they will be seen any time a user logs in
To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
1 k# @7 E$ E# n* k( z# z
Then restart the rsyslog service
systemctl restart rsyslog


4 T( h6 A- F0 G. [* l% [
+ t5 K0 r3 u  }) NCentOS 7
9 [$ G  P( }# D! F, _0 }! i$ A- ~系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示
[root@centos ~]# cat /var/log/messages
Jul 30 08:01:01 centos systemd: Started Session 235 of user root.
5 t# c; d" d% k  j8 A$ p7 {5 q: |' y9 UJul 30 08:01:01 centos systemd: Starting Session 235 of user root.
Jul 30 08:10:01 centos systemd: Started Session 236 of user root.
Jul 30 08:10:01 centos systemd: Starting Session 236 of user root.
6 \5 }+ b9 F) M' {, A) q3 dJul 30 08:20:01 centos systemd: Started Session 237 of user root.
Jul 30 08:20:01 centos systemd: Starting Session 237 of user root.
3 |. F6 _* @) rJul 30 08:30:01 centos systemd: Started Session 238 of user root.
2 R1 e9 S% x2 E% VJul 30 08:30:01 centos systemd: Starting Session 238 of user root.
/ q+ c4 h4 E- m& S, CJul 30 08:40:01 centos systemd: Started Session 239 of user root.
Jul 30 08:40:01 centos systemd: Starting Session 239 of user root.
) R3 T$ `. w; w; B% Z% ZJul 30 08:50:01 centos systemd: Started Session 240 of user root.
, Y; ]2 t4 I2 d; ]; p5 sJul 30 08:50:01 centos systemd: Starting Session 240 of user root.
- Y# X8 Y6 c4 Q3 q2 I. |8 b这似乎是某个计划任务产生的日志
[root@centos ~]# find / -name "cron.d"
/etc/cron.d
[root@centos ~]# ll /etc/cron.d/
8 ~' K( _, s1 e" k" Ttotal 8
-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly
! a5 ^$ o* J4 M; c5 G-rw-------. 1 root root 235 Apr 11 11:33 sysstat
[root@centos ~]# cat /etc/cron.d/sysstat
- l7 R7 i# e. z( i# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
( W* u" L) n" U5 Q" G+ R# Generate a daily summary of process accounting at 23:53
! j! h/ \  _1 c. E  @; q+ N53 23 * * * root /usr/lib64/sa/sa2 -A

- }: P7 C6 E" X9 N* z[root@compute01 ~]#  cat /etc/cron.d/sysstat
cat: /etc/cron.d/sysstat: No such file or directory
$ ~& h8 n5 u6 E: S% [" u$ [! y
红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下
# o6 w; b2 y, p7 m: i" c[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
6 J6 C/ H& `+ F- Z- p9 {# c[root@centos ~]# systemctl restart rsyslog