Logs not getting written to journal

Help
1

1. The problem I’m having:

I have my site configured to output the log to both stdout and a file. This should result in log entries in the syslog and the logfile.
The logfile gets the entries, the syslog doesn’t.

2. Error messages and/or full log output:

Caddy log output when restarting:

Aug 07 10:44:33 wolke.local caddy[2009410]: {"level":"info","ts":1786092273.9750357,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
Aug 07 10:44:33 wolke.local caddy[2009410]: {"level":"info","ts":1786092273.982901,"msg":"adapted config to JSON","adapter":"caddyfile"}
Aug 07 10:44:33 wolke.local caddy[1826359]: {"level":"info","ts":1786092273.9853594,"logger":"admin.api","msg":"received request","method":"POST","host":"localhost:2019","uri":"/load","remote_ip":"127.0.0.1","remote_port":"53530","headers":{"Accept-Encoding":["gzip"],"Caddy-Config-Source-Adapter":["caddyfile"],"Origin":["http://localhost:2019"],"User-Agent":["Go-http-client/1.1"],"Content-Length":["5080"],"Cache-Control":["must-revalidate"],"Caddy-Config-Source-File":["/etc/caddy/Caddyfile"],"Content-Type":["application/json"]}}
Aug 07 10:44:33 wolke.local caddy[1826359]: {"level":"info","ts":1786092273.9896705,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//[::1]:2019","//127.0.0.1:2019","//localhost:2019"]}
Aug 07 10:44:33 wolke.local caddy[1826359]: {"level":"info","ts":1786092273.9902852,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
Aug 07 10:44:33 wolke.local caddy[1826359]: {"level":"info","ts":1786092273.9903758,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.0044823,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.0046022,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"warn","ts":1786092274.016178,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"warn","ts":1786092274.0162332,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.016245,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.016263,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["www.numerfolt.de","numerfolt.de"]}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.016468,"logger":"http","msg":"servers shutting down with eternal grace period"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.0184166,"msg":"autosaved config (load with --resume flag)","file":"/var/lib/caddy/.config/caddy/autosave.json"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.0186229,"logger":"admin.api","msg":"load complete"}
Aug 07 10:44:34 wolke.local caddy[1826359]: {"level":"info","ts":1786092274.0239265,"logger":"admin","msg":"stopped previous server","address":"localhost:2019"}
Aug 07 10:44:34 wolke.local systemd[1]: Reloaded caddy.service - Caddy.

3. Caddy version:

v2.11.4 h1:XKxkMTgNSizEvKG6QHue6cAsFOteU2qA61w2tKkCWi0=

4. How I installed and ran Caddy:

Installation:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

a. System environment:

Raspbian
uname -a:
Linux wolke.local 6.18.34+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.18.34-1+rpt1 (2026-06-09) aarch64 GNU/Linux

b. Command:

/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

c. Service/unit/compose file:

# caddy.service
#
# For using Caddy with a config file.
#
# Make sure the ExecStart and ExecReload commands are correct
# for your installation.
#
# See https://caddyserver.com/docs/install for instructions.
#
# WARNING: This service does not use the --resume flag, so if you
# use the API to make changes, they will be overwritten by the
# Caddyfile next time the service is restarted. If you intend to
# use Caddy's API to configure it, add the --resume flag to the
# `caddy run` command or use the caddy-api.service file instead.

[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target

[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
TimeoutStopSec=5s
LimitNOFILE=1048576
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

d. My complete Caddy config:

/etc/caddy/Caddyfile:

{
        servers {
                trusted_proxies static private_ranges 84.151.235.113
        }
        order respond after reverse_proxy
}

import sites/www.numerfolt.de.conf

/etc/caddy/sites/www.numerfolt.de.conf:

(basis) {

        tls numerfolt@posteo.de

        @read method GET HEAD
        reverse_proxy @read 127.0.0.1:42069 {
                @fallback status 421
                handle_response @fallback {
                        root * /var/www/numerfolt
                        file_server
                }
        }

        header {
#                Access-Control-Allow-Origin: https://blog.numerfolt.de
                Cache-Control: public, s-maxage=31536000, max-age=31536000
                Content-Security-Policy "base-uri 'self'; child-src 'self'; connect-src 'self'; default-src 'none'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-src 'self'; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'none'; style-src 'self' 'unsafe-inline'; worker-src 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'"
                Cross-Origin-Opener-Policy: same-origin
                Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
                Referrer-Policy: strict-origin-when-cross-origin
                Cross-Origin-Resource-Policy: cross-origin
                Strict-Transport-Security: max-age=63072000
                X-Content-Type-Options: nosniff
                X-DNS-Prefetch-Control: off
                X-Frame-Options: DENY
                X-Permitted-Cross-Domain-Policies: none
                -Server
        }

        log {
                output stdout
                output file /var/log/caddy/numerfolt.de-access.log {
                        mode 664
                        #roll true
                        roll_size 10MiB
                        roll_uncompressed
                        roll_keep_for 36h
                }
                format json {
                        level_key level
                }
        }
}


www.numerfolt.de {
        import basis
}

numerfolt.de {
        import basis
}

5. Observed result

When accessing numerfolt.de, I get this entry in the logfile:

{"level":"info","ts":1786092045.4733725,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"84.151.234.1","remote_port":"65172","client_ip":"84.151.234.1","proto":"HTTP/2.0","method":"GET","host":"www.numerfolt.de","uri":"/favicon.ico","headers":{"Accept":["image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Referer":["https://www.numerfolt.de/"],"Sec-Fetch-Site":["same-origin"],"Dnt":["1"],"Sec-Gpc":["1"],"Priority":["u=6"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["image"],"Sec-Fetch-Mode":["no-cors"],"Te":["trailers"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"www.numerfolt.de","ech":false}},"bytes_read":0,"user_id":"","duration":0.001102922,"size":0,"status":404,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}

But it doesn’t appear in the syslog at all.

2

That’s not how you set multiple logs. You’re effectively overriding the first output, which is why you see the logs only in the file but not in stdout. You can achieve what you want by setting 2 loggers, but give them names to make the log configs distinct:

	log first {
		output stdout
	}
	log second {
		output file /var/log/caddy/numerfolt.de-access.log
		# ... rest of config
	}

[docs]

3

Thank you so much!

I thought my config would add multiple outputs to one logger…

It works perfectly fine the way you stated :slight_smile: