How to:
Re-enable /var/log/daemon.log
Logging on UCS 5.2 (Debian 12)
Overview
With the release of Debian 12 the base of UCS 5.2, there has been a fundamental shift in how system logs are handled. The traditional syslog file /var/log/syslog
is no longer the default logging destination. Instead, logging is now primarily managed by systemd-journald
.
As a result, administrators may notice that certain classic log files such as /var/log/daemon.log
are no longer updated after upgrading to UCS 5.2.
This article explains:
- What changed in Debian 12 / UCS 5.2 regarding system logging
- How to inspect logs using
journalctl
- How to re-enable classic logging for
daemon.*
messages to/var/log/daemon.log
using rsyslog - How to do so in an update-safe way without altering UCS template configurations
What’s New in Debian 12 / UCS 5.2 Logging
Default: systemd-journald
In UCS 5.2, log messages are primarily managed by systemd-journald
. This includes messages from daemons and system services. Logs are stored in a binary format and accessed via the journalctl
command.
Examples:
journalctl
journalctl -f
journalctl -u univention-directory-listener.service
journalctl -t nslcd
Workaround: Restore Logging to /var/log/daemon.log
Although systemd-journald
is sufficient for many use cases, some administrators prefer plain-text log files for familiarity, easier grepping, or integration with legacy tooling.
To restore logging to /var/log/daemon.log
, follow these steps using rsyslog.
This method is update-safe: it does not modify UCS template files and relies on configuration files under
/etc/rsyslog.d/
.
Step-by-Step Guide
1. Create a custom rsyslog config file
Create a new configuration file under /etc/rsyslog.d/
. For example:
nano /etc/rsyslog.d/10-daemon-log.conf
Add the following line:
daemon.* /var/log/daemon.log
You may optionally prefix the path with a minus (
daemon.* -/var/log/daemon.log
) to enable asynchronous writing for better performance.
2. Restart rsyslog
systemctl restart rsyslog
3. Test the configuration
Send a test log message via the logger
command:
logger -p daemon.info "Test: daemon logging re-enabled"
Now check the log:
tail /var/log/daemon.log
You should see the test entry appear.
Notes on rsyslog Configuration Priority
- rsyslog first loads
/etc/rsyslog.conf
- Then it includes all files in
/etc/rsyslog.d/
, in alphabetical order - Your file
10-daemon-log.conf
will be read after the UCS-generated default configuration and can thus override or supplement existing settings
Important Considerations
Journald-only environments:
If rsyslog is not actively forwarding messages, logs remain only in the systemd journal. Files like /var/log/daemon.log
will not be updated.
You can verify journald-only logging with:
journalctl -u univention-directory-listener.service
journalctl -t nslcd
If logs appear here but not in /var/log/daemon.log
, journald is working without rsyslog forwarding.
Summary
Logging Method | Default in UCS 5.2? | Classic Logs Available? | Requires Setup? |
---|---|---|---|
systemd-journald |
![]() |
![]() journalctl only) |
![]() |
rsyslog |
![]() |
![]() /var/log/*.log ) |
![]() |
If you rely on classic files like /var/log/daemon.log
for monitoring or troubleshooting, re-enabling rsyslog
as described ensures a familiar and reliable logging environment while remaining compatible with UCS updates.