10:01:01 compute01 systemd: Started Session 3217 of user root.

admin

10:01:01 compute01 systemd: Started Session 3217 of user root.
Resolution
These messages are normal and expected -- they will be seen any time a user logs in
To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

# ~2 P. H$ g% R! p- d! W& _Then restart the rsyslog service
systemctl restart rsyslog
, Y' X3 w5 f  m* Y: G
8 A& Q  z/ l- Y/ [" l
* G  V4 P  v% W1 Y3 ~2 H" p
CentOS 7
4 H7 r5 ]5 M! y3 y8 G# c& Y1 b; Q系统日志文件/var/log/messages出现大量重复的日志，约10分钟就出现一次，如下所示
$ R6 S/ @* L! q: q. `[root@centos ~]# cat /var/log/messages
3 S* G2 |% \6 l) c. Q- e: m) @8 Q4 TJul 30 08:01:01 centos systemd: Started Session 235 of user root.
- g+ t" W  m  A9 r; Z$ h/ \# WJul 30 08:01:01 centos systemd: Starting Session 235 of user root.
8 ~% |# f4 K0 z0 |( Z- g8 yJul 30 08:10:01 centos systemd: Started Session 236 of user root.
. o9 \; p& Y" y1 K/ v2 C; ?  RJul 30 08:10:01 centos systemd: Starting Session 236 of user root.
4 X+ u6 [8 w/ z% J- o, k* RJul 30 08:20:01 centos systemd: Started Session 237 of user root.
Jul 30 08:20:01 centos systemd: Starting Session 237 of user root.
Jul 30 08:30:01 centos systemd: Started Session 238 of user root.
Jul 30 08:30:01 centos systemd: Starting Session 238 of user root.
; |2 A1 o. o" E# b1 CJul 30 08:40:01 centos systemd: Started Session 239 of user root.
+ w( C# ^  m& @  u. rJul 30 08:40:01 centos systemd: Starting Session 239 of user root.
" S8 q- L9 x5 ?5 WJul 30 08:50:01 centos systemd: Started Session 240 of user root.
; B' @1 ^4 B  W4 m* s* @) f6 PJul 30 08:50:01 centos systemd: Starting Session 240 of user root.
这似乎是某个计划任务产生的日志
% c" ?' V1 ]) G6 e[root@centos ~]# find / -name "cron.d"
( t4 z3 ~+ t( _/ E4 l! l) |, x/etc/cron.d
[root@centos ~]# ll /etc/cron.d/
total 8
' M# w$ o& i6 y3 o6 E# m-rw-r--r--. 1 root root 128 Apr 11 09:48 0hourly
0 d: I0 I6 C, N6 x-rw-------. 1 root root 235 Apr 11 11:33 sysstat
[root@centos ~]# cat /etc/cron.d/sysstat
6 H3 j7 w& r; I2 ~. J# _# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
1 Z) q$ d9 i' M# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A
( W8 l/ ~; R$ p* O! y, I& S
[root@compute01 ~]#  cat /etc/cron.d/sysstat
cat: /etc/cron.d/sysstat: No such file or directory
' F% F% j8 p2 N0 H7 ]' K
" u( N! z3 F( V. n+ W2 G红帽官网提到这是个正常现象，只要有用户登录系统，在执行计划任务时就会有这样的日志？ 可以抑制这些日志，操作如下
[root@centos ~]# echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
[root@centos ~]# systemctl restart rsyslog
& O* d1 e2 r0 e1 o: _6 O1 {
( O, ~: @8 z, `" l- Z
6 P% f! r' D% U