Stale /var/run/nologin

[Rick Stevens]

On 01/08/2014 04:34 PM, Sam Varshavchik issued this missive:
> Rick Stevens writes:
>
>> On 01/08/2014 04:29 AM, Sam Varshavchik issued this missive:
>>
>>> But if that's getting spuriously created, during a normal system state,
>>> then something indeed must be creating it, in the wild.
>>>
>>> Not going to be easy tracking it down. Perusing journalctl's man page,
>>> there doesn't seem to be a way to specify a time interval. Given
>>> /run/nologin's timestamp, it should be possible to track down what was
>>> started in that timeframe, but I do not see a way to specify a
>>> timeframe. Furthermore, journalctl's output seems to consist of merely
>>> log messages from systemd-started processes, rather than the actual log
>>> of what was started, and when.
>>
>> 'journalctl --since=-600' will show all log messages for the last 600
>> seconds (10 minutes). Or you can use
>
> Except, as I explained, I am not looking for messages that were logged
> by systemd-started processes, in some time interval. I am looking at
> what exactly systemd started, during some time interval. Which is
> completely different from whatever got logged by a systemd-started process.
>
> At system boot, systemd fills the system console "Starting foo…"
> followed by, at some time later "Started foo…". Several pages of that.
> Most of that seems to be completely absent from the output of journalctl
> --since. Perusal of the time intervals spanning the last couple of
> reboot cycles shows that each reboot results in a grand total of one
> message: "Starting Default", and even that is not reliable, and is
> missing from several boot cycles.
>
> systemd's logging appears to be incomplete.

The stuff you're seeing is sent to the console--not the system log--so
you wouldn't see them in the standard log or journalctl anyway. It does
appear in /var/log/boot.log.

Note that by default, systemd logs at level "info" and sends the logs
to the journal or kmesg. If you want to kick it into being VERY verbose,
try changing the line:

	#LogLevel=info

in /etc/systemd/system.conf to:

	LogLevel=debug

(note the uncomment and change of level) and rebooting. Perhaps you'll
capture what it's doing. Don't forget to change it back after you
finish debugging.

I did some digging around and found the /run/nologin file is managed
by the program "/usr/lib/systemd/systemd-user-sessions" (invoked by
systemd-user-sessions.service).
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    ricks at alldigital.com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-    Working with Linux is like wrestling with a worthy opponent.    -
-   Working with Windows is like picking on an annoyed child with a  -
-                            loaded handgun.                         -
----------------------------------------------------------------------