• We value your experience with Plesk during 2024
    Plesk strives to perform even better in 2025. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2024.
    Please take this short survey:
    https://pt-research.typeform.com/to/AmZvSXkx
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Resolved systemd User Manager activity

F

fliegerhermi

Regular Pleskian
Hi,
my server was offline today for about 3hours. I guess it was a problem with max. apache workers.
However when I went through the logs I found the follow in syslog. Entries like the one are shown almost every second in syslog.
What is happening here? I think an entry is genereated everytime a mail-user logs in.
Is this normal?

Thanks.
Oct 11 15:49:39 web20 systemd[1]: Stopping User Manager for UID 10079...
Oct 11 15:49:39 web20 systemd[32155]: Stopped target Default.
Oct 11 15:49:39 web20 systemd[32155]: Stopped target Basic System.
Oct 11 15:49:39 web20 systemd[32155]: Stopped target Paths.
Oct 11 15:49:39 web20 systemd[32155]: Stopped target Sockets.
Oct 11 15:49:39 web20 systemd[32155]: Closed GnuPG cryptographic agent and passphrase cache.
Oct 11 15:49:39 web20 systemd[32155]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Oct 11 15:49:39 web20 systemd[32155]: Closed GnuPG network certificate management daemon.
Oct 11 15:49:39 web20 systemd[32155]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Oct 11 15:49:39 web20 systemd[32155]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Oct 11 15:49:39 web20 systemd[32155]: Stopped target Timers.
Oct 11 15:49:39 web20 systemd[32155]: Reached target Shutdown.
Oct 11 15:49:39 web20 systemd[32155]: Starting Exit the Session...
Oct 11 15:49:39 web20 systemd[32155]: Received SIGRTMIN+24 from PID 32217 (kill).
Oct 11 15:49:39 web20 systemd[1]: Stopped User Manager for UID 10079.
Oct 11 15:49:39 web20 systemd[1]: Removed slice user-10079.slice.
Oct 11 15:49:39 web20 systemd[1]: user-10079.slice: Consumed 997ms CPU time
Oct 11 15:49:41 web20 systemd[1]: Created slice user-10043.slice.
Oct 11 15:49:41 web20 systemd[1]: Starting User Manager for UID 10043...
Oct 11 15:49:41 web20 systemd[1]: Started Session c1857 of user mgdgpfr.
Oct 11 15:49:41 web20 systemd[32219]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Oct 11 15:49:41 web20 systemd[32219]: Listening on GnuPG cryptographic agent and passphrase cache.
Oct 11 15:49:41 web20 systemd[32219]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Oct 11 15:49:41 web20 systemd[32219]: Reached target Paths.
Oct 11 15:49:41 web20 systemd[32219]: Listening on GnuPG network certificate management daemon.
Oct 11 15:49:41 web20 systemd[32219]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Oct 11 15:49:41 web20 systemd[32219]: Reached target Sockets.
Oct 11 15:49:41 web20 systemd[32219]: Reached target Timers.
Oct 11 15:49:41 web20 systemd[32219]: Reached target Basic System.
Oct 11 15:49:41 web20 systemd[32219]: Reached target Default.
Oct 11 15:49:41 web20 systemd[32219]: Startup finished in 16ms.
Oct 11 15:49:41 web20 systemd[1]: Started User Manager for UID 10043.
Oct 11 15:49:43 web20 systemd[1]: Created slice user-10137.slice.
Oct 11 15:49:43 web20 systemd[1]: Starting User Manager for UID 10137...
Oct 11 15:49:43 web20 systemd[1]: Started Session c1858 of user (privacy-remove*).
Click to expand...
 
What's happening there?
This seems to be new behaviour. The syslog file is huge since for the last 2 days...

Thank you for the quick reply.
 
I see the same entries in my log as well generated every 30 seconds. All generated by/for system users that neither have ssh or any other login shell available. There also no cron jobs scheduled for these users.

This behaviors is rather "new" but I cannot tell since when exactly. I would definitely not call it normal.

@fliegerhermi Did you find a solution?

System is Ubuntu 18.04 with Plesk 18.0.41
 
Flachzange said:
for system users that neither have ssh or any other login shell available. There also no cron jobs scheduled for these users.
Click to expand...
It could be the start of a service, the creation of an instance of a service, e.g. a new PHP-FPM session. It could also be an attempt to login even if the user does not have SSH access. For better advice please post an excerpt of the log where you think it does not look normal.
 
Hi @Peter Debik, PHP-FPM sessions are actually a good thought. I can see the systemd logs immediately if I call a webpage. The webpage and the system user matches.

Example below

Code: 
Mar  6 16:21:00 srv systemd[1]: Created slice user-10018.slice.
Mar  6 16:21:00 srv systemd[1]: Starting User Manager for UID 10018...
Mar  6 16:21:00 srv systemd[1]: Started Session c48105 of user lobbersee.
Mar  6 16:21:00 srv systemd[11225]: Reached target Paths.
Mar  6 16:21:00 srv systemd[11225]: Listening on GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:00 srv systemd[11225]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:00 srv systemd[11225]: Listening on GnuPG network certificate management daemon.
Mar  6 16:21:00 srv systemd[11225]: Reached target Timers.
Mar  6 16:21:00 srv systemd[11225]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:00 srv systemd[11225]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:00 srv systemd[11225]: Reached target Sockets.
Mar  6 16:21:00 srv systemd[11225]: Reached target Basic System.
Mar  6 16:21:00 srv systemd[11225]: Reached target Default.
Mar  6 16:21:00 srv systemd[11225]: Startup finished in 38ms.
Mar  6 16:21:00 srv systemd[1]: Started User Manager for UID 10018.
Mar  6 16:21:01 srv systemd[1]: Started Session c48106 of user lobbersee.
Mar  6 16:21:01 srv systemd[1]: Started Session c48107 of user lobbersee.
Mar  6 16:21:01 srv systemd[1]: Started Session c48108 of user lobbersee.
Mar  6 16:21:01 srv systemd[1]: Started Session c48109 of user lobbersee.
Mar  6 16:21:13 srv systemd[1]: Created slice user-10003.slice.
Mar  6 16:21:13 srv systemd[1]: Starting User Manager for UID 10003...
Mar  6 16:21:13 srv systemd[1]: Started Session c48110 of user middelhagen.
Mar  6 16:21:13 srv systemd[11352]: Listening on GnuPG network certificate management daemon.
Mar  6 16:21:13 srv systemd[11352]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:13 srv systemd[11352]: Reached target Paths.
Mar  6 16:21:13 srv systemd[11352]: Listening on GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:13 srv systemd[11352]: Reached target Timers.
Mar  6 16:21:13 srv systemd[11352]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:13 srv systemd[11352]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:13 srv systemd[11352]: Reached target Sockets.
Mar  6 16:21:13 srv systemd[11352]: Reached target Basic System.
Mar  6 16:21:13 srv systemd[11352]: Reached target Default.
Mar  6 16:21:13 srv systemd[11352]: Startup finished in 35ms.
Mar  6 16:21:13 srv systemd[1]: Started User Manager for UID 10003.
Mar  6 16:21:16 srv systemd[1]: Stopping User Manager for UID 10018...
Mar  6 16:21:16 srv systemd[11225]: Stopped target Default.
Mar  6 16:21:16 srv systemd[11225]: Stopped target Basic System.
Mar  6 16:21:16 srv systemd[11225]: Stopped target Paths.
Mar  6 16:21:16 srv systemd[11225]: Stopped target Timers.
Mar  6 16:21:16 srv systemd[11225]: Stopped target Sockets.
Mar  6 16:21:16 srv systemd[11225]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:16 srv systemd[11225]: Closed GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:16 srv systemd[11225]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:16 srv systemd[11225]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:16 srv systemd[11225]: Closed GnuPG network certificate management daemon.
Mar  6 16:21:16 srv systemd[11225]: Reached target Shutdown.
Mar  6 16:21:16 srv systemd[11225]: Starting Exit the Session...
Mar  6 16:21:16 srv systemd[11225]: Received SIGRTMIN+24 from PID 11375 (kill).
Mar  6 16:21:16 srv systemd[1]: Stopped User Manager for UID 10018.
Mar  6 16:21:16 srv systemd[1]: Removed slice user-10018.slice.
Mar  6 16:21:16 srv systemd[1]: user-10018.slice: Consumed 1.535s CPU time
Mar  6 16:21:19 srv systemd[1]: Created slice user-10018.slice.
Mar  6 16:21:19 srv systemd[1]: Starting User Manager for UID 10018...
Mar  6 16:21:19 srv systemd[1]: Started Session c48111 of user lobbersee.
Mar  6 16:21:19 srv systemd[11452]: Reached target Paths.
Mar  6 16:21:19 srv systemd[11452]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:19 srv systemd[11452]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:19 srv systemd[11452]: Listening on GnuPG network certificate management daemon.
Mar  6 16:21:19 srv systemd[11452]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:19 srv systemd[11452]: Reached target Timers.
Mar  6 16:21:19 srv systemd[11452]: Listening on GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:19 srv systemd[11452]: Reached target Sockets.
Mar  6 16:21:19 srv systemd[11452]: Reached target Basic System.
Mar  6 16:21:19 srv systemd[1]: Started User Manager for UID 10018.
Mar  6 16:21:19 srv systemd[11452]: Reached target Default.
Mar  6 16:21:19 srv systemd[11452]: Startup finished in 33ms.
Mar  6 16:21:19 srv systemd[1]: Started Session c48112 of user lobbersee.
Mar  6 16:21:19 srv systemd[1]: Started Session c48113 of user lobbersee.
Mar  6 16:21:19 srv systemd[1]: Started Session c48114 of user lobbersee.
Mar  6 16:21:19 srv systemd[1]: Started Session c48115 of user lobbersee.
Mar  6 16:21:28 srv postfix/scache[9870]: statistics: start interval Mar  6 16:18:08
Mar  6 16:21:28 srv postfix/scache[9870]: statistics: domain lookup hits=0 miss=2 success=0%
Mar  6 16:21:28 srv postfix/scache[9870]: statistics: address lookup hits=0 miss=2 success=0%
Mar  6 16:21:35 srv systemd[1]: Stopping User Manager for UID 10018...
Mar  6 16:21:35 srv systemd[11452]: Stopped target Default.
Mar  6 16:21:35 srv systemd[11452]: Stopped target Basic System.
Mar  6 16:21:35 srv systemd[11452]: Stopped target Timers.
Mar  6 16:21:35 srv systemd[11452]: Stopped target Paths.
Mar  6 16:21:35 srv systemd[11452]: Stopped target Sockets.
Mar  6 16:21:35 srv systemd[11452]: Closed GnuPG network certificate management daemon.
Mar  6 16:21:35 srv systemd[11452]: Closed GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:35 srv systemd[11452]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:35 srv systemd[11452]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:35 srv systemd[11452]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:35 srv systemd[11452]: Reached target Shutdown.
Mar  6 16:21:35 srv systemd[11452]: Starting Exit the Session...
Mar  6 16:21:35 srv systemd[11452]: Received SIGRTMIN+24 from PID 11562 (kill).
Mar  6 16:21:35 srv systemd[1]: Stopped User Manager for UID 10018.
Mar  6 16:21:35 srv systemd[1]: Removed slice user-10018.slice.
Mar  6 16:21:35 srv systemd[1]: user-10018.slice: Consumed 1.433s CPU time
Mar  6 16:21:47 srv systemd[1]: Started Session 40827 of user christoph.
Mar  6 16:21:52 srv systemd[1]: Stopping User Manager for UID 10003...
Mar  6 16:21:52 srv systemd[11352]: Stopped target Default.
Mar  6 16:21:52 srv systemd[11352]: Stopped target Basic System.
Mar  6 16:21:52 srv systemd[11352]: Stopped target Paths.
Mar  6 16:21:52 srv systemd[11352]: Stopped target Sockets.
Mar  6 16:21:52 srv systemd[11352]: Closed GnuPG cryptographic agent and passphrase cache.
Mar  6 16:21:52 srv systemd[11352]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Mar  6 16:21:52 srv systemd[11352]: Closed GnuPG network certificate management daemon.
Mar  6 16:21:52 srv systemd[11352]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Mar  6 16:21:52 srv systemd[11352]: Stopped target Timers.
Mar  6 16:21:52 srv systemd[11352]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar  6 16:21:52 srv systemd[11352]: Reached target Shutdown.
Mar  6 16:21:52 srv systemd[11352]: Starting Exit the Session...
Mar  6 16:21:52 srv systemd[11352]: Received SIGRTMIN+24 from PID 11741 (kill).
Mar  6 16:21:52 srv systemd[1]: Stopped User Manager for UID 10003.
Mar  6 16:21:52 srv systemd[1]: Removed slice user-10003.slice.
Mar  6 16:21:52 srv systemd[1]: user-10003.slice: Consumed 688ms CPU time
 
I only noticed now that this approach stops the majority of logging into syslog including maillog. So it is not really a solution.
 
You must log in or register to reply here.

Similar threads

L
Question Many log-entrys after update to Debian 12 and Plesk 18.0.61
Replies
2
Views
477
Larian
L
J
Resolved Logs and proFtpd
Replies
5
Views
562
JuanCar
J
Ankebut
Resolved PHP 8.1 Another FPM instance seems to already listen on [...] php-fpm.sock
2
Replies
26
Views
13K
Ankebut
Ankebut
M
Question fail2ban, can I ban visitors with no user agent?
Replies
1
Views
630
Kaspar@Plesk
Kaspar@Plesk
J
Resolved [PPPM-13304] Update failed Almalinux 8.4 -> 8.5
Replies
15
Views
3K
Nik G
N
Back
Top