Centos messages flooded with Create slice, Removed slice

Posted on April 21, 2020  •  2 minutes  • 222 words  •  Suggest Changes

In Centos 7/8 /var/log/messages is flooded with this :

Apr 21 08:40:01 tinky systemd: Created slice User Slice of root.
Apr 21 08:40:01 tinky systemd: Started Session 1709 of user root.
Apr 21 08:40:01 tinky systemd: Removed slice User Slice of root.
Apr 21 08:50:01 tinky systemd: Created slice User Slice of root.
Apr 21 08:50:01 tinky systemd: Started Session 1710 of user root.
Apr 21 08:50:01 tinky systemd: Removed slice User Slice of root.
Apr 21 09:00:01 tinky systemd: Created slice User Slice of root.
Apr 21 09:00:01 tinky systemd: Started Session 1711 of user root.

Highly annoying sometimes and unneeded writes IMHO; Luckely we can filter those out, or if you want you can redirect them to a different file (see how).

You can stop this with adding a rule to rsyslog ignoring all these, adding a rule like : /etc/rsyslog.d/ignore-systemd-session-slice.conf

if $programname == "systemd" and 
  (
  $msg contains "Starting Session" or 
  $msg contains "Started Session" or 
  $msg contains "Created slice" or
  $msg contains "Starting user-" or 
  $msg contains "Starting User Slice of" or 
  $msg contains "Removed session" or 
  $msg contains "Removed slice User Slice of" or 
  $msg contains "Stopping User Slice of"
  )
then stop

Provided by the good folk of RedHat. Don’t forget to restart rsyslogd.

service rsyslogd restart
# or
systemctl restart rsyslog

happy logging (useful stuff)