概述
在日常运维中发现，系统日志里记录了大量的无用信息，使查看日志非常麻烦，可以设置一些过滤条件，使这些无用的日志不再出现在日志当中
问题描述
在/var/log/messages中，出现大量无用信息，如下：
Sep 14 14:20:01 timescale systemd: Started Session 38043 of user root.
Sep 14 14:20:01 timescale systemd: Starting Session 38043 of user root.
Sep 14 14:30:01 timescale systemd: Started Session 38044 of user root.
Sep 14 14:30:01 timescale systemd: Starting Session 38044 of user root.
Sep 14 14:40:01 timescale systemd: Started Session 38045 of user root.
Sep 14 14:40:01 timescale systemd: Starting Session 38045 of user root.
Sep 14 14:50:01 timescale systemd: Started Session 38046 of user root.
Sep 14 14:50:01 timescale systemd: Starting Session 38046 of user root.
Sep 14 15:00:01 timescale systemd: Started Session 38047 of user root.
Sep 14 15:00:01 timescale systemd: Starting Session 38047 of user root.
Sep 14 15:01:01 timescale systemd: Started Session 38048 of user root.
Sep 14 15:01:01 timescale systemd: Starting Session 38048 of user root.
Sep 14 15:10:01 timescale systemd: Started Session 38049 of user root.
Sep 14 15:10:01 timescale systemd: Starting Session 38049 of user root.
Sep 14 15:20:01 timescale systemd: Started Session 38050 of user root.
Sep 14 15:20:01 timescale systemd: Starting Session 38050 of user root.
Sep 14 15:30:01 timescale systemd: Started Session 38051 of user root.
Sep 14 15:30:01 timescale systemd: Starting Session 38051 of user root.
Sep 14 15:38:12 timescale systemd: Started Session 38052 of user root.
Sep 14 15:38:12 timescale systemd: Starting Session 38052 of user root.
Sep 14 15:38:12 timescale systemd-logind: New session 38052 of user root.
Sep 14 15:40:01 timescale systemd: Started Session 38053 of user root.
Sep 14 15:40:01 timescale systemd: Starting Session 38053 of user root.
Sep 14 15:50:01 timescale systemd: Started Session 38054 of user root.
Sep 14 15:50:01 timescale systemd: Starting Session 38054 of user root.
操作步骤
将过滤的条件加入#Add Filter
echo 'if ($programname == "systemd-logind" or $programname == "systemd") and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Removed session" or $msg contains "New session" or $msg contains "Created slice" or $msg contains "Starting user-") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
重启日志服务#Restart Syslog
systemctl restart rsyslog