(In reply to Achim Klausmann from comment #61) Ah ... the usage of su explains a lot as in this case the pam configuration falls in (compare /etc/pam.d/su and /etc/pam.d/su-l). And this pam based commands should be avoided for SysVinit/LSB services as with pam the login manager will handle the user session. All sessions do belong to the user.slice and this will be terminated before the system.slice. This can be viewed with e.g. systemd-cgls or systemd-cgtop or ps awx -eo pid,args,cgroup maybe the command systemd-run may help as replacement for the `su' or `runuser' command: systemd-run --uid=oracle as a test I've executed two commands runuser nobody -c '/usr/bin/sleep 1000 &' systemd-run --uid=nobody /usr/bin/sleep 1000 and indeed ps awx -eo pid,args,cgroup | grep sleep 13381 /usr/bin/sleep 1000 1:name=systemd:/user.slice/user-0.slice/session-375.scope 13718 /usr/bin/sleep 1000 1:name=systemd:/system.slice/run-13717.service 13722 grep --color=auto sleep 1:name=systemd:/user.slice/user-223.slice/session-382.scope