The systemd service file firewalld.service contains the following settings: # supress to log debug and error output also to /var/log/messages StandardOutput=null StandardError=null At least errors, but potentially also normal information messages, should be send to the journal. /var/log/firewalld seems to be not used for those kinds of messages.