The accounting tool has a timer. [chris@f27s ~]$ sudo systemctl status sysstat-collect.timer ● sysstat-collect.timer - Run system activity accounting tool every 10 minutes Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; vendor preset: enabled) Active: active (waiting) since Sat 2017-11-11 21:04:17 MST; 18h ago Trigger: Sun 2017-11-12 15:30:00 MST; 3min 27s left Nov 11 21:04:17 f27s.localdomain systemd[1]: Started Run system activity accounting tool every 10 minutes. And it pretty much starts and stops instantly. Nov 12 15:20:11 f27s.localdomain systemd[1]: Starting system activity accounting tool... Nov 12 15:20:11 f27s.localdomain systemd[1]: Started system activity accounting tool. Nov 12 15:20:11 f27s.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sysstat-collect comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Nov 12 15:20:11 f27s.localdomain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sysstat-collect comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' So that's one mystery solved. There's still the issue of creating/removing slice User Slice of pcp, and the Starting/Stopping User Manager fo UID 989 that keeps happening. --- Chris Murphy _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx