diff --git a/constants.go b/constants.go
index 7d83faa987ca2..c55f3f8f7433b 100644
--- a/constants.go
+++ b/constants.go
@@ -307,6 +307,9 @@ const (
 
 	// HumanDateFormatMilli is a human readable date formatting with milliseconds
 	HumanDateFormatMilli = "Jan _2 15:04:05.000 UTC"
+
+	// DebugLevel is a debug logging level name
+	DebugLevel = "debug"
 )
 
 // Component generates "component:subcomponent1:subcomponent2" strings used
diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 749e44c5a2ad4..7b2113d0c15e5 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -204,7 +204,11 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 	case "stdout", "out", "1":
 		log.SetOutput(os.Stdout)
 	case teleport.Syslog:
-		utils.SwitchLoggingtoSyslog()
+		err := utils.SwitchLoggingtoSyslog()
+		if err != nil {
+			// this error will go to stderr
+			log.Errorf("Failed to switch logging to syslog: %v.", err)
+		}
 	default:
 		// assume it's a file path:
 		logFile, err := os.Create(fc.Logger.Output)
@@ -220,14 +224,13 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 		log.SetLevel(log.InfoLevel)
 	case "err", "error":
 		log.SetLevel(log.ErrorLevel)
-	case "debug":
+	case teleport.DebugLevel:
 		log.SetLevel(log.DebugLevel)
 	case "warn", "warning":
 		log.SetLevel(log.WarnLevel)
 	default:
 		return trace.BadParameter("unsupported logger severity: '%v'", fc.Logger.Severity)
 	}
-
 	// apply cache policy for node and proxy
 	cachePolicy, err := fc.CachePolicy.Parse()
 	if err != nil {
@@ -808,6 +811,12 @@ func Configure(clf *CommandLineFlags, cfg *service.Config) error {
 			return trace.Wrap(err)
 		}
 	}
+
+	// apply command line --debug flag to override logger severity
+	if clf.Debug {
+		fileConf.Logger.Severity = teleport.DebugLevel
+	}
+
 	if err = ApplyFileConfig(fileConf, cfg); err != nil {
 		return trace.Wrap(err)
 	}
@@ -826,10 +835,9 @@ func Configure(clf *CommandLineFlags, cfg *service.Config) error {
 		cfg.Proxy.DisableTLS = clf.DisableTLS
 	}
 
-	// apply --debug flag:
+	// apply --debug flag to config:
 	if clf.Debug {
 		cfg.Console = ioutil.Discard
-		utils.InitLogger(utils.LoggingForDaemon, log.DebugLevel)
 		cfg.Debug = clf.Debug
 	}
 
diff --git a/lib/utils/syslog.go b/lib/utils/syslog.go
index acb9871d57136..cc89e96da7ebf 100644
--- a/lib/utils/syslog.go
+++ b/lib/utils/syslog.go
@@ -23,21 +23,23 @@ import (
 	"log/syslog"
 	"os"
 
+	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 	logrusSyslog "github.com/sirupsen/logrus/hooks/syslog"
 )
 
 // SwitchLoggingtoSyslog tells the logger to send the output to syslog. This
 // code is behind a build flag because Windows does not support syslog.
-func SwitchLoggingtoSyslog() {
+func SwitchLoggingtoSyslog() error {
 	log.StandardLogger().SetHooks(make(log.LevelHooks))
 	hook, err := logrusSyslog.NewSyslogHook("", "", syslog.LOG_WARNING, "")
 	if err != nil {
-		// syslog not available
+		// syslog is not available
 		log.SetOutput(os.Stderr)
-	} else {
-		// ... and disable stderr:
-		log.AddHook(hook)
-		log.SetOutput(ioutil.Discard)
+		return trace.Wrap(err)
 	}
+	log.AddHook(hook)
+	// ... and disable stderr:
+	log.SetOutput(ioutil.Discard)
+	return nil
 }