I am having the same issue on Ubuntu 16.04 now. All sessions appear to be for one user that is used for incoming ssh connections for rsync. Here's an example:
$ loginctl show-session 59 Id=59 User=1004 Name=raccess Timestamp=Чт 2018-03-29 20:20:03 MSK TimestampMonotonic=1763641802 VTNr=0 Remote=yes RemoteHost=216.126.59.227 Service=sshd Scope=session-59.scope Leader=2814 Audit=59 Type=tty Class=user Active=yes State=closing IdleHint=no IdleSinceHint=0 IdleSinceHintMonotonic=0
I don't see any processes running under user raccess apart from system ones:
$ ps aux | grep raccess | grep -v grep raccess 2822 0.0 1.6 6384 4132 ? Ss 20:20 0:00 /lib/systemd/systemd --user raccess 2823 0.0 0.4 7316 1096 ? S 20:20 0:00 (sd-pam)
And here's an output of lsof -u raccess: https://pbin.cf/444b2d29
This is happening on two servers.
I am having the same issue on Ubuntu 16.04 now. All sessions appear to be for one user that is used for incoming ssh connections for rsync. Here's an example:
$ loginctl show-session 59 nic=1763641802 216.126. 59.227 59.scope notonic= 0
Id=59
User=1004
Name=raccess
Timestamp=Чт 2018-03-29 20:20:03 MSK
TimestampMonoto
VTNr=0
Remote=yes
RemoteHost=
Service=sshd
Scope=session-
Leader=2814
Audit=59
Type=tty
Class=user
Active=yes
State=closing
IdleHint=no
IdleSinceHint=0
IdleSinceHintMo
I don't see any processes running under user raccess apart from system ones:
$ ps aux | grep raccess | grep -v grep systemd --user
raccess 2822 0.0 1.6 6384 4132 ? Ss 20:20 0:00 /lib/systemd/
raccess 2823 0.0 0.4 7316 1096 ? S 20:20 0:00 (sd-pam)
And here's an output of lsof -u raccess: https:/ /pbin.cf/ 444b2d29
This is happening on two servers.