[aws] systemd 로그 메시지 중 사용자 슬라이스(user slice) 로그 메시지를 제거하는 방법

systemd 로그 메시지 중 사용자 슬라이스(user slice) 로그 메시지를 제거하는 방법

테스트 환경

$ cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"

• messages 로그

tail -f /var/log/messages

$ tail -f /var/log/messages
Feb 22 20:51:01 aws-server-01 systemd: Created slice User Slice of webapps.
Feb 22 20:51:01 aws-server-01 systemd: Started Session 489743 of user webapps.
Feb 22 20:51:04 aws-server-01 systemd: Removed slice User Slice of webapps.
Feb 22 20:51:25 aws-server-01 dhclient[2029]: XMT: Solicit on eth0, interval 128450ms.
Feb 22 20:52:01 aws-server-01 systemd: Created slice User Slice of webapps.
Feb 22 20:52:01 aws-server-01 systemd: Started Session 489744 of user webapps.
Feb 22 20:52:02 aws-server-01 systemd: Removed slice User Slice of webapps.
Feb 22 20:53:01 aws-server-01 systemd: Created slice User Slice of webapps.
Feb 22 20:53:01 aws-server-01 systemd: Started Session 489745 of user webapps.
Feb 22 20:53:01 aws-server-01 systemd: Removed slice User Slice of webapps.
Feb 22 20:53:33 aws-server-01 dhclient[2029]: XMT: Solicit on eth0, interval 130050ms.

• ignore-systemd-session-slice.conf 파일 생성

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' > /etc/rsyslog.d/ignore-systemd-session-slice.conf

• ignore-systemd-session-slice.conf 파일 확인

cat /etc/rsyslog.d/ignore-systemd-session-slice.conf

$ cat /etc/rsyslog.d/ignore-systemd-session-slice.conf
if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop

• rsyslog 서비스 재시작

systemctl restart rsyslog.service

• rsyslog 서비스 상태 확인

systemctl status rsyslog.service

$ systemctl status rsyslog.service
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2023-02-22 21:13:23 KST; 7s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 15896 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─15896 /usr/sbin/rsyslogd -n
...
Hint: Some lines were ellipsized, use -l to show in full.