logging_ipv{4,6}.conf: detect ulogd2 via systemd instead of ps.

ps also lists the ulogd of LXC containers (which do not receive the NFLOG
packets of the host) and misses ulogd2 if the firewall starts first at boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

conf/logging_ipv4.conf

@@ -5,7 +5,12 @@
 # --- Logging
 # -------------
 
-if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then 
+# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
+# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
+# receive the NFLOG packets of the host (other network namespace); at boot
+# the firewall may also start before ulogd2.
+if systemctl is-enabled --quiet ulogd2 2>/dev/null \
+      || systemctl is-active --quiet ulogd2 2>/dev/null ; then
    tag_log_prefix="--nflog-prefix"
    LOG_TARGET="NFLOG --nflog-group 11"
 else 

conf/logging_ipv6.conf

@@ -5,7 +5,12 @@
 # --- Logging
 # -------------
 
-if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then 
+# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
+# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
+# receive the NFLOG packets of the host (other network namespace); at boot
+# the firewall may also start before ulogd2.
+if systemctl is-enabled --quiet ulogd2 2>/dev/null \
+      || systemctl is-active --quiet ulogd2 2>/dev/null ; then
    tag_log_prefix="--nflog-prefix"
    LOG_TARGET="NFLOG --nflog-group 12"
 else