How-to: Re-enable /var/log/daemon.log Logging on UCS 5.2

Knowledge Base Community
, , , , ,
1

How to:

Re-enable /var/log/daemon.log Logging on UCS 5.2 (Debian 12)

Overview

With the release of Debian 12 the base of UCS 5.2, there has been a fundamental shift in how system logs are handled. The traditional syslog file /var/log/syslog is no longer the default logging destination. Instead, logging is now primarily managed by systemd-journald.

As a result, administrators may notice that certain classic log files such as /var/log/daemon.log are no longer updated after upgrading to UCS 5.2.

This article explains:

  • What changed in Debian 12 / UCS 5.2 regarding system logging
  • How to inspect logs using journalctl
  • How to re-enable classic logging for daemon.* messages to /var/log/daemon.log using rsyslog
  • How to do so in an update-safe way without altering UCS template configurations

:pushpin: What’s New in Debian 12 / UCS 5.2 Logging

Default: systemd-journald

In UCS 5.2, log messages are primarily managed by systemd-journald. This includes messages from daemons and system services. Logs are stored in a binary format and accessed via the journalctl command.

Examples:

journalctl
journalctl -f
journalctl -u univention-directory-listener.service
journalctl -t nslcd

:gear: Workaround: Restore Logging to /var/log/daemon.log

Although systemd-journald is sufficient for many use cases, some administrators prefer plain-text log files for familiarity, easier grepping, or integration with legacy tooling.

To restore logging to /var/log/daemon.log, follow these steps using rsyslog.

This method is update-safe: it does not modify UCS template files and relies on configuration files under /etc/rsyslog.d/.

Step-by-Step Guide

1. Create a custom rsyslog config file

Create a new configuration file under /etc/rsyslog.d/. For example:

nano /etc/rsyslog.d/10-daemon-log.conf

Add the following line:

daemon.*    /var/log/daemon.log

You may optionally prefix the path with a minus (daemon.* -/var/log/daemon.log) to enable asynchronous writing for better performance.

2. Restart rsyslog

systemctl restart rsyslog

3. Test the configuration

Send a test log message via the logger command:

logger -p daemon.info "Test: daemon logging re-enabled"

Now check the log:

tail /var/log/daemon.log

You should see the test entry appear.

:lock: Notes on rsyslog Configuration Priority

  • rsyslog first loads /etc/rsyslog.conf
  • Then it includes all files in /etc/rsyslog.d/, in alphabetical order
  • Your file 10-daemon-log.conf will be read after the UCS-generated default configuration and can thus override or supplement existing settings

:warning: Important Considerations

Journald-only environments:

If rsyslog is not actively forwarding messages, logs remain only in the systemd journal. Files like /var/log/daemon.log will not be updated.

You can verify journald-only logging with:

journalctl -u univention-directory-listener.service
journalctl -t nslcd

If logs appear here but not in /var/log/daemon.log, journald is working without rsyslog forwarding.

:books: Summary

Logging Method Default in UCS 5.2? Classic Logs Available? Requires Setup?
systemd-journald :white_check_mark: Yes :x: No (journalctl only) :x: Already active
rsyslog :white_check_mark: Yes :white_check_mark: Yes (/var/log/*.log) :white_check_mark: Manual config

If you rely on classic files like /var/log/daemon.log for monitoring or troubleshooting, re-enabling rsyslog as described ensures a familiar and reliable logging environment while remaining compatible with UCS updates.

1 Like