http://jackxiang.com/index.php zh-cn http://jackxiang.com/post// jack <xdy108@126.com> Tue, 27 Mar 2018 12:42:50 +0000 http://jackxiang.com/post//
Mar 27 20:39:01 localhost systemd: Starting Session 17 of user root.
Mar 27 20:40:01 localhost systemd: Started Session 18 of user root.
Mar 27 20:40:01 localhost systemd: Starting Session 18 of user root.
Mar 27 20:40:01 localhost systemd: Started Session 19 of user root.
Mar 27 20:40:01 localhost systemd: Starting Session 19 of user root.
Mar 27 20:40:12 localhost systemd: Starting Cleanup of Temporary Directories...
Mar 27 20:40:12 localhost systemd: Started Cleanup of Temporary Directories.
Mar 27 20:41:01 localhost systemd: Started Session 20 of user root.
Mar 27 20:41:01 localhost systemd: Starting Session 20 of user root.
Mar 27 20:42:01 localhost systemd: Stopping System Logging Service...

echo 'if ($programname == "systemd-logind" or $programname == "systemd") and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Removed session" or $msg contains "New session" or $msg contains "Created slice" or $msg contains "Starting user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf


#Restart Syslog
systemctl restart rsyslog

[root@localhost ~]# systemctl restart rsyslog
您在 /var/spool/mail/root 中有新邮件
来自：https://access.redhat.com/solutions/1564823
https://www.linuxquestions.org/questions/linux-security-4/systemd-started-session-of-user-root-in-var-log-messages-4175515978/ ]]> http://jackxiang.com/post//#blogcomment <user@domain.com> Thu, 01 Jan 1970 00:00:00 +0000 http://jackxiang.com/post//#blogcomment