标题：[实践OK]"systemd: Started Session ### of user root" in /var/log/messages 出处：向东博客 专注WEB应用 构架之美 --- 构架之美，在于尽态极妍 | 应用之美，在于药到病除 时间：Tue, 27 Mar 2018 20:42:50 +0000 作者：jackxiang 地址：http://jackxiang.com/post/9688/ 内容： tail -f /var/log/messages Mar 27 20:39:01 localhost systemd: Starting Session 17 of user root. Mar 27 20:40:01 localhost systemd: Started Session 18 of user root. Mar 27 20:40:01 localhost systemd: Starting Session 18 of user root. Mar 27 20:40:01 localhost systemd: Started Session 19 of user root. Mar 27 20:40:01 localhost systemd: Starting Session 19 of user root. Mar 27 20:40:12 localhost systemd: Starting Cleanup of Temporary Directories... Mar 27 20:40:12 localhost systemd: Started Cleanup of Temporary Directories. Mar 27 20:41:01 localhost systemd: Started Session 20 of user root. Mar 27 20:41:01 localhost systemd: Starting Session 20 of user root. Mar 27 20:42:01 localhost systemd: Stopping System Logging Service... echo 'if ($programname == "systemd-logind" or $programname == "systemd") and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Removed session" or $msg contains "New session" or $msg contains "Created slice" or $msg contains "Starting user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf #Restart Syslog systemctl restart rsyslog [root@localhost ~]# systemctl restart rsyslog 您在 /var/spool/mail/root 中有新邮件 来自：https://access.redhat.com/solutions/1564823 https://www.linuxquestions.org/questions/linux-security-4/systemd-started-session-of-user-root-in-var-log-messages-4175515978/ Generated by Jackxiang's Bo-blog 2.1.1 Release