From a0e573f1aef0d786649bfe9c1beee3b998ab6a33 Mon Sep 17 00:00:00 2001 From: Christoph Date: Wed, 11 Nov 2026 23:17:05 +0100 Subject: [PATCH] Role ipt-server: detect ulogd2 via systemd instead of ps (logging_ipv{4,6}.conf). Co-Authored-By: Claude Opus 5.5 --- roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf | 7 ++++++- roles/ipt-server/files/etc/ipt-firewall/logging_ipv6.conf | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf b/roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf index db2cab1..b6aaa94 100644 --- a/roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf +++ b/roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf @@ -5,7 +5,12 @@ # --- Logging # ------------- -if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then +# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself. +# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not +# receive the NFLOG packets of the host (other network namespace); at boot +# the firewall may also start before ulogd2. +if systemctl is-enabled --quiet ulogd2 2>/dev/null \ + || systemctl is-active --quiet ulogd2 2>/dev/null ; then tag_log_prefix="--nflog-prefix" LOG_TARGET="NFLOG --nflog-group 11" else diff --git a/roles/ipt-server/files/etc/ipt-firewall/logging_ipv6.conf b/roles/ipt-server/files/etc/ipt-firewall/logging_ipv6.conf index da09863..5914b41 100644 --- a/roles/ipt-server/files/etc/ipt-firewall/logging_ipv6.conf +++ b/roles/ipt-server/files/etc/ipt-firewall/logging_ipv6.conf @@ -5,7 +5,12 @@ # --- Logging # ------------- -if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then +# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself. +# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not +# receive the NFLOG packets of the host (other network namespace); at boot +# the firewall may also start before ulogd2. +if systemctl is-enabled --quiet ulogd2 2>/dev/null \ + || systemctl is-active --quiet ulogd2 2>/dev/null ; then tag_log_prefix="--nflog-prefix" LOG_TARGET="NFLOG --nflog-group 12" else