CentOS 7 的 /var/log/messages 系统记录內会大量出现 slice User 的信息如下:

Dec 20 01:00:01 feel systemd: Started Session 6755 of user root.
Dec 20 01:00:01 feel systemd: Removed slice User Slice of root.
Dec 20 01:01:01 feel systemd: Created slice User Slice of root.
Dec 20 01:01:01 feel systemd: Started Session 6756 of user root.
Dec 20 01:01:01 feel systemd: Removed slice User Slice of root.
Dec 20 01:10:01 feel systemd: Created slice User Slice of root.
Dec 20 01:10:01 feel systemd: Started Session 6757 of user root.
Dec 20 01:10:01 feel systemd: Removed slice User Slice of root.
Dec 20 01:20:01 feel systemd: Created slice User Slice of root.
Dec 20 01:20:01 feel systemd: Started Session 6758 of user root.
Dec 20 01:20:01 feel systemd: Removed slice User Slice of root.
Dec 20 01:30:01 feel systemd: Created slice User Slice of root.
Dec 20 01:30:01 feel systemd: Started Session 6759 of user root.

主要的原因是和 systemd有关，可以通过过滤规则来隐藏

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf

systemctl restart rsyslog

参考来源
https://access.redhat.com/solutions/1564823