31

I have a new CentOS 7 installation, and noticed that my /var/log/messages file is full of messages like this

Mar 6 08:40:01 myhostname systemd: Started Session 2043 of user root. Mar 6 08:40:01 myhostname systemd: Starting Session 2043 of user root. Mar 6 08:40:01 myhostname systemd: Created slice user-1001.slice. Mar 6 08:40:01 myhostname systemd: Starting user-1001.slice. Mar 6 08:40:01 myhostname systemd: Started Session 2042 of user userx. Mar 6 08:40:01 myhostname systemd: Starting Session 2042 of user userx. Mar 6 08:40:01 myhostname systemd: Started Session 2041 of user root. Mar 6 08:40:01 myhostname systemd: Starting Session 2041 of user root. Mar 6 08:40:31 myhostname systemd: Removed slice user-1001.slice. Mar 6 08:40:31 myhostname systemd: Stopping user-1001.slice. Mar 6 08:41:01 myhostname systemd: Created slice user-1001.slice. Mar 6 08:41:01 myhostname systemd: Starting user-1001.slice. Mar 6 08:41:01 myhostname systemd: Started Session 2044 of user userx. Mar 6 08:41:01 myhostname systemd: Starting Session 2044 of user userx. Mar 6 08:41:21 myhostname systemd: Removed slice user-1001.slice. Mar 6 08:41:21 myhostname systemd: Stopping user-1001.slice.

What do all of these mean, and why are they there? If this is normal background noise them it seems like an enourmous waste to of resources to log this...

Improve this question

2 Answers 2

Reset to default
31

(this question is also answered over on superuser here )

Those are messages pertaining to the creation and deletion of slices, which are used in systemd to group processes and manage their resources.

Why they are logged by default escapes me but I've seen two ways to disable them:

  1. The less intrusive way is to filter them out by creating /etc/rsyslog.d/ignore-systemd-session-slice.conf with the following contents:

    if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed Slice" or $msg contains "Stopping user-") then stop

    and restart rsyslogd with systemctl restart rsyslog

  2. The broader way is to set the systemd logging level a bit higher by editing /etc/systemd/system.conf:

     #LogLevel=info LogLevel=notice

References:

Improve this answer
3
  • Had to change if statement to if $programname contains "systemd" because program name is called systemd-logind Commented Jan 15, 2019 at 10:21
  • @Aidas, out of curiosity, what distro/systemd version? Commented Jan 16, 2019 at 12:53
  • 1
    CentOS Linux release 7.5.1804 (Core) Commented Feb 12, 2019 at 15:59
3

These messages are normal and expected -- they will be seen any time a user logs in or e.g. a cron job is executed for the user.

To suppress these log entries in /var/log/messages, create a discard filter with rsyslog, e.g., run the following command:

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

Then restart the rsyslog service

systemctl restart rsyslog

https://access.redhat.com/solutions/1564823

Improve this answer
2
  • Are you sure they are shown when a user logs in? Monitoring /var/log/messages show this when myuser logs in: May 26 12:24:46 myhost systemd-logind: New session 40686 of user myuser. May 26 12:24:46 myhost systemd: Started Session 40686 of user myuser., not the slice messages. I am interested in knowing the cause of slice messages. Commented May 26, 2020 at 11:30
  • 1
    @nephewtom slices are a systemd resource management term. In my case there's a cron job checking the system health, it creates these messages. Commented Jul 28, 2020 at 14:51

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.