Loginctl list-sessions increasing sessions

Hi

I know it’s a long shot but just in case other people have encountered this issue:

I’m creating a brand new VPS with ubuntu 18.04 and virtualmin. I have root user and I have a “domain” user that was created as part of the virtual server/domain/site I created on the new VPS.

After it was created I ran: loginctl list-sessions and saw X sessions. After awhile it got up to 91 then 99 and now 103. It seems that the number is increasing but nothing removes them from the list. Their TTY is ???.

Should it be like that? Something operates behind the scenes that is causing it? Anything special I should check for? Because the user is responsible for the virtual server defined in virtualmin, I guess it is related to how virtualmin operates?

After another 12 hours: 209 sessions. I checked several of them and they are Active=yes and State=closing. I followed these instructions: https://www.thegeekstuff.com/2011/05/openssh-options/ and put 150 and 2 respectively but it doesn’t see to do any effect.

Thanks

Hi,

This doesn’t seem as Virtualmin related.

Few tips:

  1. Check the status of those sessions by running
    loginctl session-status ID;
  2. Check and investigate on those active connections by running journalctl -xe |grep session;
  3. Check /etc/systemd/system.conf, probably something got mis-reconfigured.

Did you try locking down the access to the system in different ways to find out under which circumstances it could stop?


Those are just the tips, and it doesn’t seem as Virtualmin issue and should be asked some place else.

Thank you for the tip. I did a small test. I logged in using SSH with user root, logged out and then re-logged in again. As expected I see 2 sessions for root. using loginctl session-status ID I see one active and one closing (as expected) but the closing remains like that “for good”.

I checked loginctl session-status ID for user domain and the state is closing as if the connection is made and immediately closed but remains in the list.

journalctl -xe |grep session ; shows that a new session has started for user domain and that’s it. I don’t see any source that opened the session.

In /etc/systemd/system.conf everything is commented out. Is there something I should set there?

I have no idea why domain user keeps connecting to the system in order to know how to stop it. Obviously it started after I defined the virtual server in virtualmin. That’s the reason I think virtualmin may be the reason but that’s just a guess.

Every 2-3 minutes I see in syslog: systemd[1]: Started Session c... of user domain. Each time c… increased by 1… How can I know who/what is creating those sessions? They are immediately closed but not cleared from the list. has anyone here this kind of logging in his syslog file?

After running loginctl you get user id (UID). Try getting more info about the user and its processes in session scopes by running:

systemd-cgls -u user-UID.slice # replace `UID` with valid user id

systemd-logind is responsible to manage and track sessions.

Have a look at:

  1. man systemd-logind
  2. /etc/systemd/logind.conf

Check CRON jobs:

crontab -l

Do they correspond with the logs you’re seeing?

Command w can show who is logged on and what they are doing.

systemd-cgls -u user-UID.slice

Unit user-1000.slice (/user.slice/user-1000.slice):
└─session-2691929.scope
├─19035 sshd: domain [priv]
├─19051 sshd: domain@pts/0
├─19052 -bash
├─20124 sudo systemd-cgls -u user-1000.slice
├─20125 systemd-cgls -u user-1000.slice
└─20126 pager

everything is in comment

crontab for domain is empty
crontab for root has only /etc/webmin/status/monitor.pl to run every hour.

The above open/close is done every 5 minutes. I’ve found nothing that runs every 5 minute.

w shows only my own login (ssh), the other sessions are opened and immediately closed but stay in “active=yes” and “state=closing”.