Systemd-logind spamming my logs since F41 -> F43 upgrade

Ask Fedora
1

Hi,

Since i upgraded from F41 to F43, systemd-logind is spamming my logs with this messages every second:

/var/log/messages:

Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: New session ‘c235021’ of user ‘root’ with class ‘background-light’ and type ‘unspecified’.
Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: Session c235021 logged out. Waiting for processes to exit.
Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: Removed session c235021.
Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: New session ‘c235022’ of user ‘root’ with class ‘background-light’ and type ‘unspecified’.
Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: Session c235022 logged out. Waiting for processes to exit.
Nov 21 13:21:40 myhost.mydomain.com systemd-logind[2294]: Removed session c235022.

/var/log/secure:

Nov 21 13:21:40 myhost.mydomain.com sudo[481528]: pam_systemd(sudo:session): Failed to check if /run/user/0/bus exists, ignoring: Permission denied
Nov 21 13:21:40 myhost.mydomain.com sudo[481528]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=972)
Nov 21 13:21:40 myhost.mydomain.com sudo[481528]: pam_unix(sudo:session): session closed for user root
Nov 21 13:21:40 myhost.mydomain.com sudo[481532]: pam_systemd(sudo:session): Failed to check if /run/user/0/bus exists, ignoring: Permission denied
Nov 21 13:21:40 myhost.mydomain.com sudo[481532]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=972)
Nov 21 13:21:40 myhost.mydomain.com sudo[481532]: pam_unix(sudo:session): session closed for user root

Anyone has any idea what might causing this?

2

You didn’t mention how you did the upgrade. I use DNF offline system upgrade, followed by:
https://docs.fedoraproject.org/en-US/quick-docs/upgrading-fedora-offline/#sect-optional-post-upgrade-tasks. I think “optional” is a bit optimistic – some .rpmnew files contain bug fixes. You should also review any lingering F41 packages.

3

Yes, i used dnf system-upgrade, and followed all post upgrade tasks.

4 
% grep 972 /etc/passwd                                                                   
libvirtdbus:x:976:972:Libvirt D-Bus bridge:/:/sbin/nologin

It could help to describe how you use VM’s so others with similar configurations can find this topic.

You can also look for bug reports in Bugzilla and GitLab issues for Libvirt such as:
Libvirt D-Bus bug reports that fit your situation.

5

Found the culprit, in my case actually user id 972 is zabbix-agent.

Thanks for the hint on user id, didn’t even notice it in the logs :frowning:

As soon as i stopped zabbix-agent, messages no longer appear.

Now need to find out why zabbix-agent is doing this.

6

I see the same issue with every sudo invocation, seems to be just an annoyance, but a change from F41 nonetheless. Likely coming from:

$  grep pam_systemd /etc/pam.d/system-auth
-session    optional                                     pam_systemd.so
1 Like
7

I was able to solve the spam of all the zabbix sudo invocations by adding on /etc/pam.d/system-auth:

session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = zabbix

before:

-session optional pam_systemd.so

and before:

session required pam_unix.so

And also adding:

Defaults:zabbix !syslog

to /etc/sudoers

1 Like