Centos messages flooded with Create slice, Removed slice

Posted 21 April, 2020

In Centos 7/8 /var/log/messages is flooded with this :

Apr 21 08:40:01 tinky systemd: Created slice User Slice of root.
Apr 21 08:40:01 tinky systemd: Started Session 1709 of user root.
Apr 21 08:40:01 tinky systemd: Removed slice User Slice of root.
Apr 21 08:50:01 tinky systemd: Created slice User Slice of root.
Apr 21 08:50:01 tinky systemd: Started Session 1710 of user root.
Apr 21 08:50:01 tinky systemd: Removed slice User Slice of root.
Apr 21 09:00:01 tinky systemd: Created slice User Slice of root.
Apr 21 09:00:01 tinky systemd: Started Session 1711 of user root.

Highly annoying sometimes and unneeded writes IMHO; Luckely we can filter those out, or if you want you can redirect them to a different file (see how).

You can stop this with adding a rule to rsyslog ignoring all these, adding a rule like : /etc/rsyslog.d/ignore-systemd-session-slice.conf

if $programname == "systemd" and 
  (
  $msg contains "Starting Session" or 
  $msg contains "Started Session" or 
  $msg contains "Created slice" or
  $msg contains "Starting user-" or 
  $msg contains "Starting User Slice of" or 
  $msg contains "Removed session" or 
  $msg contains "Removed slice User Slice of" or 
  $msg contains "Stopping User Slice of"
  )
then stop

Provided by the good folk of RedHat. Don’t forget to restart rsyslogd.

service rsyslogd restart
# or
systemctl restart rsyslog

happy logging (useful stuff)

If you enjoyed this article, please consider buying me a Dr Pepper.
Fuel the beast!

Buy me a Dr PepperBuy me a Dr Pepper



Show Comments (0)
© SvennD