Екатерина Шемаева, в /var/log/messages только скудная информация такого вида:
...
Feb 26 10:55:01 proshina systemd: Started Session 48665 of user bitrix.
Feb 26 10:55:01 proshina systemd: Created slice User Slice of root.
Feb 26 10:55:01 proshina systemd: Started Session 48664 of user root.
Feb 26 10:55:01 proshina systemd: Started Session 48668 of user bitrix.
Feb 26 10:55:01 proshina systemd: Started Session 48669 of user root.
Feb 26 10:55:01 proshina systemd: Started Session 48663 of user root.
Feb 26 10:55:01 proshina systemd: Started Session 48670 of user root.
Feb 26 10:55:01 proshina systemd: Started Session 48666 of user root.
Feb 26 10:55:01 proshina systemd: Started Session 48667 of user bitrix.
Feb 26 10:55:01 proshina systemd: Created slice User Slice of munin.
Feb 26 10:55:02 proshina systemd: Started Session 48673 of user root.
Feb 26 10:55:02 proshina systemd: Started Session 48671 of user munin.
Feb 26 10:55:02 proshina systemd: Started Session 48672 of user root.
Feb 26 10:55:02 proshina systemd: Started Session 48674 of user root.
Feb 26 10:55:06 proshina systemd: Removed slice User Slice of bitrix.
Feb 26 10:55:09 proshina systemd: Removed slice User Slice of root.
Feb 26 10:55:25 proshina systemd: Removed slice User Slice of munin.
Feb 26 10:56:02 proshina systemd: Created slice User Slice of bitrix.
Feb 26 10:56:02 proshina systemd: Started Session 48675 of user bitrix.
Feb 26 10:56:02 proshina systemd: Created slice User Slice of root.
Feb 26 10:56:02 proshina systemd: Started Session 48676 of user root.
Feb 26 10:56:02 proshina systemd: Started Session 48677 of user bitrix.
Feb 26 10:56:02 proshina systemd: Started Session 48678 of user bitrix.
Feb 26 10:56:02 proshina systemd: Started Session 48679 of user root.
Feb 26 10:56:03 proshina systemd: Removed slice User Slice of root.
Feb 26 10:56:04 proshina systemd: Removed slice User Slice of bitrix.
Feb 26 10:57:02 proshina systemd: Created slice User Slice of root.
Feb 26 10:57:02 proshina systemd: Started Session 48680 of user root.
...