I did loginctl terminate-user domain before so now I have 47 such sessions.
domain@domain:~$ ps -alx F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 4 0 1 0 20 0 232712 10960 ep_pol Ss ? 152:21 /lib/systemd/systemd --system --deserialize 12 1 0 2 1 20 0 0 0 kthrea S ? 0:00 [kthreadd/79baa9] 1 0 3 2 20 0 0 0 kthrea S ? 0:00 [khelper] 4 105 139 1 20 0 189016 988 poll_s Ssl ? 0:03 /usr/sbin/rsyslogd -n 4 0 149 1 20 0 88660 19704 ep_pol Ss ? 1:32 /lib/systemd/systemd-logind 4 0 152 1 20 0 28344 376 hrtime Ss ? 0:02 /usr/sbin/cron -f 4 100 153 1 20 0 48428 1944 ep_pol Ss ? 2:57 /usr/bin/dbus-daemon --system --address=systemd: --4 0 163 1 20 0 196840 18732 poll_s Ssl ? 0:00 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork -1 0 204 1 20 0 100968 80 skb_wa Ss ? 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix1 0 205 204 20 0 100968 92 lock_f S ? 0:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix5 118 261 1 20 0 76184 15964 poll_s Ss ? 0:00 postgrey --pidfile=/var/run/postgrey/postgrey.pid -4 106 478 1 20 0 287428 12804 sigsus Ssl ? 0:00 /usr/sbin/named -f -u bind 4 0 489 1 20 0 184288 7800 poll_s Ssl ? 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/una4 0 505 1 20 0 1036648 13412 poll_s Ssl ? 39:19 /usr/bin/python3 /usr/bin/fail2ban-server -xf start4 0 523 1 20 0 72288 916 poll_s Ss ? 0:00 /usr/sbin/sshd -D 0 999 526 1 20 0 4192092 693668 futex_ Sl ? 42:25 /usr/lib/jvm/java-11-openjdk-amd64/bin/java -Djava.1 0 542 1 20 0 24176 256 poll_s Ss ? 0:00 /usr/sbin/xinetd -pidfile /run/xinetd.pid -stayaliv5 0 555 1 20 0 400524 16044 poll_s Ss ? 0:44 /usr/sbin/apache2 -k start 1 0 579 1 20 0 81052 18024 poll_s Ss ? 0:12 /usr/bin/perl /usr/share/usermin/miniserv.pl /etc/u1 0 581 1 20 0 87416 15492 poll_s Ss ? 0:34 /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/we5 33 3714 555 20 0 400956 9468 ep_pol S ? 0:00 /usr/sbin/apache2 -k start 5 33 3716 555 20 0 400892 9352 SYSC_s S ? 0:00 /usr/sbin/apache2 -k start 4 0 5194 1 20 0 76500 1740 ep_pol Ss ? 0:00 /lib/systemd/systemd --user 5 0 5195 5194 20 0 261960 7528 sigtim S ? 0:00 (sd-pam) 4 0 5342 1 20 0 289044 2016 poll_s Ssl ? 0:07 /usr/lib/policykit-1/polkitd --no-debug 4 101 5968 1 20 0 71848 156 ep_pol Ss ? 0:00 /lib/systemd/systemd-networkd 4 0 5975 1 20 0 197976 49068 ep_pol Ss ? 0:12 /lib/systemd/systemd-journald 4 0 6087 1 20 0 42092 308 ep_pol Ss ? 0:00 /lib/systemd/systemd-udevd 5 114 6831 1 20 0 120580 2148 poll_s Ss ? 0:02 proftpd: (accepting connections) 4 0 9525 5194 20 0 90368 224 poll_s SLs ? 0:00 /usr/bin/gpg-agent --supervised 1 0 9928 1 20 0 90368 288 poll_s Ss ? 0:00 gpg-agent --homedir /root/.gnupg --use-standard-soc5 33 10880 555 20 0 400964 9324 SYSC_s S ? 0:00 /usr/sbin/apache2 -k start 4 113 11187 1 20 0 302396 6484 pause Ss ? 0:08 /usr/bin/freshclam -d --foreground=true 5 33 11901 555 20 0 400688 8748 SYSC_s S ? 0:00 /usr/sbin/apache2 -k start 4 0 13481 1 20 0 13008 844 poll_s Ss+ ? 0:00 /sbin/agetty -o -p -- \u --noclear tty2 linux 4 0 13482 1 20 0 13008 844 poll_s Ss+ ? 0:00 /sbin/agetty -o -p -- \u --noclear --keep-baud cons4 0 17557 523 20 0 101548 4356 poll_s Ss ? 0:00 sshd: domain [priv] 5 1000 17572 17557 20 0 101548 1960 poll_s R ? 0:00 sshd: domain@pts/0 0 1000 17573 17572 20 0 18628 2128 wait Ss pts/0 0:00 -bash 0 1000 17583 17573 20 0 25936 1276 - R+ pts/0 0:00 ps -alx 4 0 18418 1 20 0 317440 1580 ep_pol Ss ? 0:34 php-fpm: master process (/etc/php/7.2/fpm/php-fpm.c5 33 18419 18418 20 0 317440 1452 skb_wa S ? 0:00 php-fpm: pool www 5 33 18420 18418 20 0 317440 1448 skb_wa S ? 0:00 php-fpm: pool www 5 33 22504 555 20 0 182440 5768 poll_s S ? 0:00 /usr/sbin/apache2 -k start 5 33 23288 555 20 0 400988 9672 SYSC_s S ? 0:00 /usr/sbin/apache2 -k start The command journalctl -b -u systemd-logind starts with Feb-07 so there are A LOT of records there. Maybe a grep of something will show only the important stuff? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1863228 Title: loginctl list-sessions shows ghost sessions that are never completely closed Status in systemd package in Ubuntu: Incomplete Bug description: I setup a new VPS with ubuntu 18.04.4, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New session c315 of user domain . su[12936]: pam_unix(su:session): session opened for user domain by (uid=0) su[12936]: pam_unix(su:session): session closed for user domain in syslog, I see a lot of systemd[1]: Started Session c314 of user domain. systemd[1]: Started Session c315 of user domain. domain is the user of my virtual server defined in the VPS. c314/c315 increased by 1 each time, every 5 minutes (see explanation below). When running `loginctl list-sessions` those sessions number grow as "active=yes" and "state=closing" and never disappear from the list. a random session as an example: loginctl session-status c315 c315 - domain (1000) Since: Sat 2020-02-08 20:27:08 UTC; 23h ago Leader: 12936 TTY: ??? Remote: user root Service: su; type tty; class user State: closing Unit: session-c315.scope I did a simple test: logged in with ssh, logged out (exit) and re- logged in. I saw 2 sessions in loginctl list-sessions and the previous one, which I obviously closed, never disappeared from the list. as a "bonus": Virtualmin apparently open/close a session for the virtual server user to do its stuff causing the number of ghost sessions to grow forever... I posted this question in server fault, askubuntu, ubuntuforums and virtualmin - no one knew what to tell me. I have no idea what/where to look for... Please advice :) Thanks in advance. FWIW: Someone from virtualmin forum told me that he had a similar problem with debian 9 and it was fixed in debian 10. After a boot I see this, maybe related? Feb 13 06:39:48 domain systemd[1]: Starting User Manager for UID 1000... Feb 13 06:39:48 domain systemd[636]: Failed to create /user.slice/user-1000.slice/user@1000.service/init.scope control group: Permission denied Feb 13 06:39:48 domain systemd[636]: Failed to allocate manager object: Permission denied Feb 13 06:39:48 domain systemd[1]: user@1000.service: Failed with result 'protocol'. Feb 13 06:39:48 domain systemd[1]: Failed to start User Manager for UID 1000 lsb_release -a; uname -a; grep 1000 /etc/passwd No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04.4 LTS Release: 18.04 Codename: bionic Linux domain.com 4.15.0 #1 SMP Mon Dec 9 19:36:21 MSK 2019 x86_64 x86_64 x86_64 GNU/Linux domain:x:1000:1000::/home/domain:/bin/bash To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1863228/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp