From f0187f041d063f6921ee9f5920fd2901427e3f3e Mon Sep 17 00:00:00 2001 From: Christoph Date: Wed, 11 Nov 2026 23:17:04 +0100 Subject: [PATCH] logging_ipv{4,6}.conf: detect ulogd2 via systemd instead of ps. ps also lists the ulogd of LXC containers (which do not receive the NFLOG packets of the host) and misses ulogd2 if the firewall starts first at boot. Co-Authored-By: Claude Opus 5.5 --- conf/logging_ipv4.conf | 7 ++++++- conf/logging_ipv6.conf | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/conf/logging_ipv4.conf b/conf/logging_ipv4.conf index db2cab1..b6aaa94 100644 --- a/conf/logging_ipv4.conf +++ b/conf/logging_ipv4.conf @@ -5,7 +5,12 @@ # --- Logging # ------------- -if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then +# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself. +# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not +# receive the NFLOG packets of the host (other network namespace); at boot +# the firewall may also start before ulogd2. +if systemctl is-enabled --quiet ulogd2 2>/dev/null \ + || systemctl is-active --quiet ulogd2 2>/dev/null ; then tag_log_prefix="--nflog-prefix" LOG_TARGET="NFLOG --nflog-group 11" else diff --git a/conf/logging_ipv6.conf b/conf/logging_ipv6.conf index da09863..5914b41 100644 --- a/conf/logging_ipv6.conf +++ b/conf/logging_ipv6.conf @@ -5,7 +5,12 @@ # --- Logging # ------------- -if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then +# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself. +# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not +# receive the NFLOG packets of the host (other network namespace); at boot +# the firewall may also start before ulogd2. +if systemctl is-enabled --quiet ulogd2 2>/dev/null \ + || systemctl is-active --quiet ulogd2 2>/dev/null ; then tag_log_prefix="--nflog-prefix" LOG_TARGET="NFLOG --nflog-group 12" else