Hi,

[ Could you keep 920@??? in the CC:, please? ]

On Wed, Nov 05, 2025 at 04:59:41PM +0000, Bob Bowles wrote:
> I did the following: login, did some random activity while monitoring
> the memory, then left the terminal open monitoring memory at 16:03,
> near as. Came back at 16:12 and watched while the system logged me
> out. Then I went into console to check the logs, and found the last
> entries in the user.log, timestamped 16:12:52. There is an error
> message from pulseaudio. Could that be it?

Possibly. Let's delve down that rabbit hole.

Does /run exist? What are it's perms?

$ ls -ld /run
drwxr-xr-x 28 root root 1200 Nov 5 06:44 /run

Is it mounted as a tmpfs?

$ df -h /run
Filesystem      Size  Used Avail Use% Mounted on
tmpfs           392M  884K  391M   1% /run

Does run/user/$USER exist and what are it's perms?

$ ls -ld /run/user/$(id -u)
drwx------ 10 mark root 320 Nov 5 16:29 /run/user/1000

>From the pulseaudio error you found, I think that may fail. If it fails, why?
Have you got libpam-elogind installed?(I use seatd and consolekit, so I don't
have the correct output to hand, but the following should produce something
useful).

$ dpkg -l libpam-elogind libelogind-compat

Is elogind running?

$ loginctl

Is $XDG_RUNTIME_DIR set?

$ echo $XDG_RUNTIME_DIR
/run/user/1000

By this point we should hopefully have a clearer picture.

Mark