systemd: Started Session *** of user root

admin

系统message日志无故报 systemd: Started Session :
( z( @/ Q4 M" P% r2 r7 _Oct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
8 P+ j/ x6 H- i' `8 ^Oct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
7 K4 w3 r* s. w) E! N) `9 C* {Oct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
Oct 20 09:12:29 controller2 systemd: Started Session 111 of user root.
. _  I. z  F  U! A5 _^C
[root@controller2 ~]#

解决办法：添加syslog配置
[root@controller2 ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
[root@controller2 ~]#  
[root@controller2 ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf


[root@controller2 ~]# tail -f /var/log/messages
: t4 U4 h$ b3 r$ OOct 20 08:10:01 controller2 systemd: Started Session 102 of user root.
4 x" i7 m* t' W' \Oct 20 08:20:01 controller2 systemd: Started Session 103 of user root.
Oct 20 08:30:01 controller2 systemd: Started Session 104 of user root.
Oct 20 08:40:01 controller2 systemd: Started Session 105 of user root.
+ ]8 N; q: X+ ]$ bOct 20 08:50:01 controller2 systemd: Started Session 106 of user root.
Oct 20 09:00:01 controller2 systemd: Started Session 107 of user root.
Oct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
Oct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
Oct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
8 F9 H8 t+ F7 C9 f; H+ q$ {Oct 20 09:12:29 controller2 systemd: Started Session 111 of user root.


重启syslog
^C
[root@controller2 ~]# systemctl restart rsyslog

& T' a9 b4 o9 w9 _1 i6 b
[root@controller2 ~]# tail -f /var/log/messages
8 n- D. {' F  }Oct 20 09:01:19 controller2 systemd: Started Session 108 of user root.
Oct 20 09:10:01 controller2 systemd: Started Session 110 of user root.
Oct 20 09:12:29 controller2 systemd-logind: New session 111 of user root.
7 p( D7 r$ f6 \Oct 20 09:12:29 controller2 systemd: Started Session 111 of user root.
4 g6 `8 u2 n2 L9 hOct 20 09:15:11 controller2 systemd: Stopping System Logging Service...
2 q+ _( a$ S1 T# ~Oct 20 09:15:11 controller2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-55.el7" x-pid="1072" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 20 09:15:11 controller2 systemd: Stopped System Logging Service.
Oct 20 09:15:11 controller2 systemd: Starting System Logging Service...
Oct 20 09:15:11 controller2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-55.el7" x-pid="221370" x-info="http://www.rsyslog.com"] start
Oct 20 09:15:11 controller2 systemd: Started System Logging Service.

暂未报错：
+ |# }! z& w3 l( w4 }- T

admin

  手动修改配置文件：
6 [. \) U8 ?1 k. {% P! M( Y
将/etc/systemd/system.conf 中 LogLevel=info 设置成如下：
" C: F) m1 e. o4 f. ?0 \8 }
#LogLevel=info
LogLevel=notice

方法三：
1 M- n2 d$ d. F( L0 h, ?4 V通过系统命令，修改日志配置文件：
- k; C# R2 h+ K- j1 _8 jsystemd-analyze set-log-level notice

三、Linux服务器的日志管理
: Q6 l6 i4 I( k/ \0 h1 L* o: k& N消息紧急程度排行：
/ F! ?: b; E9 @emerg:该系统不可用
alert：需要立即修改
crit：紧急情况
( D, g: t% x3 M, T+ V2 Terr：错误信息
warning：预警信息
7 J/ B, c4 b: C  A& L* r6 T. l! @notice：具有重要性的普通条件
$ L% \) z; d4 ninfo：提供信息的消息
debug：不包含函数条件或问题的其他信息
, r1 W1 o' t7 Q% d; M6 xnone：没有重要级，通常用于排错
+ r& C; n5 z. ~4 P. M& C! E1 F5 Z