If you use persistent journals (probably the default on TW), you should be able to read the old logs from previous boots(see man journalctl and the '-b' option). Otherwise I would recommend to switch to persistent journal mode (by creating /var/log/journal directory and restart systemd-journald.service). Could you try the following test (several time if you can't reproduce): 0/ enable the debug logs: "systemd-analyze set-log-level debug" 1/ try to login (as a regular user) via your display manager (GDM, LXDM, ...) and start all applications you use to execute (chromium, firefox, ...). 2/ open a root session (via ssh for example) 3/ in your root session: retrieve the session number created when you logged in as a regular user by executing "loginctl" 4/ in your root session: stop your regular session with "systemctl stop session-<id>.scope" where "id" is the session number you found in the previous step. 5/ if the command is stuck, this means that you reproduced the issue otherwise back to step 1/ 6/ so the command is stuck which probably means that a process is failing to react to the SIGTERM sent by systemd when you stopped/closed your user session. In that case please show the content of the following commands: 6.1/ ps aux 6.2/ systemd-cgls 6.3/ journalctl -b Thanks !