Syslog

充滿會話和切片消息的系統日誌

  • June 28, 2019

我有一個新的 CentOS 7 安裝,並註意到我的 /var/log/messages 文件充滿了這樣的消息

Mar  6 08:40:01 myhostname systemd: Started Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2043 of user root.
Mar  6 08:40:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:40:01 myhostname systemd: Started Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Starting Session 2042 of user userx.
Mar  6 08:40:01 myhostname systemd: Started Session 2041 of user root.
Mar  6 08:40:01 myhostname systemd: Starting Session 2041 of user root.
Mar  6 08:40:31 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:40:31 myhostname systemd: Stopping user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Created slice user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Starting user-1001.slice.
Mar  6 08:41:01 myhostname systemd: Started Session 2044 of user userx.
Mar  6 08:41:01 myhostname systemd: Starting Session 2044 of user userx.
Mar  6 08:41:21 myhostname systemd: Removed slice user-1001.slice.
Mar  6 08:41:21 myhostname systemd: Stopping user-1001.slice.

所有這些是什麼意思,為什麼它們在那裡?如果這是正常的背景噪音,那麼記錄這些似乎是對資源的巨大浪費……

(這裡的超級使用者也回答了這個問題)

這些是與切片的創建和刪除有關的消息,它們在 systemd 中用於對程序進行分組並管理它們的資源。

為什麼預設情況下會記錄它們讓我無法理解,但我已經看到了兩種禁用它們的方法:

  1. 侵入性較小的方法是通過使用以下內容創建 /etc/rsyslog.d/ignore-systemd-session-slice.conf 來過濾掉它們:
if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Removed Slice" or $msg contains "Stopping user-") then stop

並重新啟動 rsyslogdsystemctl restart rsyslog 2. 更廣泛的方法是通過編輯將 systemd 日誌記錄級別設置得更高一點/etc/systemd/system.conf

#LogLevel=info
LogLevel=notice

參考:

引用自:https://unix.stackexchange.com/questions/267965