diff --git a/conf/logging_ipv4.conf b/conf/logging_ipv4.conf
index db2cab1..b6aaa94 100644
--- a/conf/logging_ipv4.conf
+++ b/conf/logging_ipv4.conf
@@ -5,7 +5,12 @@
 # --- Logging
 # -------------
 
-if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then 
+# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
+# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
+# receive the NFLOG packets of the host (other network namespace); at boot
+# the firewall may also start before ulogd2.
+if systemctl is-enabled --quiet ulogd2 2>/dev/null \
+      || systemctl is-active --quiet ulogd2 2>/dev/null ; then
    tag_log_prefix="--nflog-prefix"
    LOG_TARGET="NFLOG --nflog-group 11"
 else 
diff --git a/conf/logging_ipv6.conf b/conf/logging_ipv6.conf
index da09863..5914b41 100644
--- a/conf/logging_ipv6.conf
+++ b/conf/logging_ipv6.conf
@@ -5,7 +5,12 @@
 # --- Logging
 # -------------
 
-if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then 
+# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
+# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
+# receive the NFLOG packets of the host (other network namespace); at boot
+# the firewall may also start before ulogd2.
+if systemctl is-enabled --quiet ulogd2 2>/dev/null \
+      || systemctl is-active --quiet ulogd2 2>/dev/null ; then
    tag_log_prefix="--nflog-prefix"
    LOG_TARGET="NFLOG --nflog-group 12"
 else