Logs flooded with systemd messages: Created slice, Starting Session or Starting User Manager, Reached target

Resolution

• On RHEL 7, create a discard filter in a rsyslog.d/ drop-in configuration file, e.g.,

  # vi /etc/rsyslog.d/0-ignore-systemd-session-slice.conf
  if $programname == "systemd" and ($msg contains "Starting Session" 
                                 or $msg contains "Started Session" 
                                 or $msg contains "Created slice" 
                                 or $msg contains "Starting user-" 
                                 or $msg contains "Starting User Slice of" 
                                 or $msg contains "Removed session" 
                                 or $msg contains "Removed slice User Slice of" 
                                 or $msg contains "Stopping User Slice of") then stop
  

• On RHEL 8 and later, also create a rsyslog.d drop-in configuration file but with two discard filters in it, e.g.,

  # vi /etc/rsyslog.d/0-ignore-systemd-session-slice.conf
  if $programname == "systemd" and ($msg contains "User Manager for UID"
                                  or $msg contains "user@" 
                                  or $msg contains "run-user-"
                                  or $msg contains "user-runtime-dir@"
                                  or $msg contains "slice User Slice of UID"
                                  or $msg contains "User runtime directory /run/user/" ) then stop
  
  if ($programname == "systemd" and $procid != "1") and
                             (  $msg contains "slice User Application Slice"
                             or $msg contains "Queued start job for default target Main User Target"
                             or $msg contains "Mark boot as successful after the user"
                             or $msg contains "Daily Cleanup of User's Temporary Directories"
                             or $msg contains "D-Bus User Message Bus Socket"
                             or $msg contains "Create User's Volatile Files and Directories"
                             or $msg contains "Exit the Session"
                             or $msg contains "Reached target"
                             or $msg contains "Stopped target"
                             or $msg contains "Startup finished in"
                             ) then stop
  

  Then restart the rsyslog service:

  # systemctl restart rsyslog
  

  NOTE: In case the filter only works for local syslog logging (/var/log/messages) but does not work for remote syslog servers then we can understand this rule is read after syslog events are sent to the remote syslog server. In order to avoid this add the rule directly in rsyslog.conf above the line of remote syslog forwarding configuration. (*.* @logcollector:514 server)

• Alternatively, In RHEL 8 and later you can prevent logging of anything done by the user under it's session at the `systemd --user session level (systemd-journald)

  • enable lingering for the user so systemd --user instance will continue running even when user has no active sessions (this will show the logs but only once as there will be no session getting closed):

    # loginctl enable-linger testuser
    

  or

  • restrict logging for systemd user manager for the user (change "1000" with the user's actual UID) (this will impact logging of this specific user):

    # mkdir /etc/systemd/system/user@1000.service.d
    # cat > /etc/systemd/system/user@1000.service.d/logging.conf <<EOF
    [Service]
    LogLevelMax=notice
    EOF
    

  or

  • restrict logging for systemd user manager globally (this will impact logging for all users):

    # sed -i -e 's/#LogLevel=info/LogLevel=notice/' /etc/systemd/user.conf
    

WARNING: This last method will prevent logging of anything executed within the user session that does not generates events of notice or above.