diff --git a/common/rfb/SSecurityTLS.cxx b/common/rfb/SSecurityTLS.cxx
index e6202a8..2ea84e0 100644
--- a/common/rfb/SSecurityTLS.cxx
+++ b/common/rfb/SSecurityTLS.cxx
@@ -35,7 +35,6 @@
 #include <rdr/TLSOutStream.h>
 
 #define DH_BITS 1024 /* XXX This should be configurable! */
-#define TLS_DEBUG
 
 using namespace rfb;
 
@@ -46,13 +45,12 @@
 ("x509key", "specifies path to the key of the x509 certificate in PEM format", "", ConfServer);
 
 static LogWriter vlog("TLS");
+static LogWriter vlog_raw("RawTLS");
 
-#ifdef TLS_DEBUG
 static void debug_log(int level, const char* str)
 {
   vlog.debug(str);
 }
-#endif
 
 void SSecurityTLS::initGlobal()
 {
@@ -62,10 +60,11 @@
     if (gnutls_global_init() != GNUTLS_E_SUCCESS)
       throw AuthFailureException("gnutls_global_init failed");
 
-#ifdef TLS_DEBUG
-    gnutls_global_set_log_level(10);
-    gnutls_global_set_log_function(debug_log);
-#endif
+    /* 100 means debug log */
+    if (vlog_raw.getLevel() >= 100) {
+      gnutls_global_set_log_level(10);
+      gnutls_global_set_log_function(debug_log);
+    }
 
     globalInitDone = true;
   }