Problem: journalctl Reports Errors: "Failed to open directory /dev/null/.config/systemd"

logging
systemd

#1

Apr 15 10:58:37 ucs systemd[27863]: Failed to open directory /dev/null/.config/systemd/user/run-user-2327.mount.wants: Not a directory
Apr 15 10:58:37 ucs systemd[27863]: Failed to open directory /dev/null/.config/systemd/user/run-user-2327.mount.requires: Not a directory
Apr 15 10:58:37 ucs systemd[27863]: Failed to open directory /dev/null/.local/share/systemd/user/run-user-2327.mount.wants: Not a directory
Apr 15 10:58:37 ucs systemd[27863]: Failed to open directory /dev/null/.local/share/systemd/user/run-user-2327.mount.requires: Not a directory

Problem

journalctl -xe reports loads of the following messages:

Apr 15 10:58:37 ucs systemd[31025]: Failed to open directory /dev/null/.config/systemd/user/run-user-2327.mount.wants: Not a directory
Apr 15 10:58:37 ucs systemd[31025]: Failed to open directory /dev/null/.config/systemd/user/run-user-2327.mount.requires: Not a directory
Apr 15 10:58:37 ucs systemd[31025]: Failed to open directory /dev/null/.local/share/systemd/user/run-user-2327.mount.wants: Not a directory
Apr 15 10:58:37 ucs systemd[31025]: Failed to open directory /dev/null/.local/share/systemd/user/run-user-2327.mount.requires: Not a directory

Solution

These messages can be ignored. It is a bug in systemd trying to access user configuration from their configured home directories. But for system user (like nagios) the home directories are usually set to /dev/null to prevent interactive logins.
But systemd tries these user’s home directories anyways and fails as /dev/null is not a directory.

These messages can be safely ignored.

In case you have issues with this filling up your disk space you might want to change systemd logging or use the following untested workaround:

Step 1

Create an empty directory, e.g. /var/lib/empty-dummy-home

Step 2

Modify all accounts whose home directory is /dev/null so that their home directory becomes /var/lib/empty-dummy-home
To identify these accounts use getent passwd | grep /dev/null

Alternatively:

You can use rsyslog to filter the events:

# cat > /etc/rsyslog.d/SUPPORT-filter-sd-pam-events.conf <<EOF
:msg, contains, "Failed to open directory /dev/null/" stop
:msg, contains, "Listening on GnuPG network certificate management daemon." stop
:msg, contains, "Listening on GnuPG cryptographic agent" stop
:msg, ereregex, "^.*(Reached|Stopped) target (Timers|Paths|Sockets|Basic System|Default|Shutdown).$" stop
:msg, contains, "Closed GnuPG cryptographic agent" stop
:msg, contains, "Closed GnuPG network certificate management daemon." stop
EOF
# service rsyslog restart

You can adjust the filter


Problem with systemd-journal after upgrade to ucs 4.3-4 from 4.3-3
After upgrade to ucs 4.3-4 /var/log/journal grows up