Synology

Discover the power of Synology’s innovative NAS solutions. Streamline your data management, enhance collaboration, and safeguard your files with ease.

Synology Moments Explained: Features & Limits

Synology

What Is Synology Moments? Features, Limitations & How It Works

Before Synology Photos became the unified media platform in DSM 7, Synology Moments was Synology’s AI-powered personal photo management solution. Designed to compete with services like Google Photos, Moments focused on automatic organization, intelligent tagging, and mobile backup, all while keeping your data on your own NAS. Compare Synology Moments with popular cloud photo storage services.

Although Moments has now been merged into Synology Photos in newer DSM versions, many users still run it on older systems or encounter it when researching Synology’s photo ecosystem. Understanding how it works helps clarify what it offered and why it evolved.

What Is Synology Moments?

Synology Moments is a photo management application built for Synology NAS devices. It automatically organizes photos using artificial intelligence, grouping images by people, subjects, and locations.

Unlike simple folder-based storage, Moments scans images, analyzes metadata, and categorizes photos without requiring manual organization. It creates a personal cloud experience where users can upload, browse, and search photos from anywhere. Build a secure private photo cloud using Synology NAS storage.

Moments runs entirely on your NAS. This means your photos never leave your infrastructure unless you choose to sync or share them externally.

How Synology Moments Works

Moments relies on DSM’s indexing service and built-in AI recognition engine.

When photos are uploaded, either through mobile apps or manual transfer, the system:

Indexes image files
Extracts metadata such as date and location
Performs facial recognition and object detection
Organizes photos into searchable categories

The more images added, the more refined its recognition becomes.

Mobile apps for iOS and Android allow automatic camera backup. Once enabled, photos taken on your phone sync directly to your NAS over Wi-Fi or mobile data. Fix common Synology Moments WAN backup issues affecting remote photo syncing.

All processing happens locally on the NAS hardware. Performance depends heavily on the CPU and available RAM of your device.

Key Features of Synology Moments

AI-Based Organization

Moments automatically groups photos by people, subjects, and places. It identifies faces and suggests groupings, similar to major cloud photo platforms. Learn how Synology Moments uses AI recognition and search tags.

Timeline View

Photos are displayed chronologically, making it easy to browse memories by date.

Mobile Backup

Automatic upload from smartphones ensures photos are protected without manual transfers.

Smart Search

Users can search for keywords like “beach,” “car,” or “dog” if the AI tagging has detected those objects.

Shared Albums

Photos can be shared internally or externally via links with permission controls.

Data Ownership

All data remains stored on your NAS, giving you full control over privacy and retention.

Limitations of Synology Moments

Despite its strengths, Moments had several limitations.

First, it was primarily designed for personal use rather than enterprise media workflows. Advanced metadata editing, professional tagging structures, and granular permission control were limited.

Second, performance could become sluggish on lower-end NAS models. AI indexing is resource-intensive, and without sufficient CPU power, background processing slowed considerably.

Third, it lacked deep collaboration tools. While sharing was possible, Moments did not offer structured project management or advanced team-based media handling.

Finally, Moments and Photo Station were separate applications in DSM 6, leading to user confusion. This separation was later resolved when Synology combined both systems into Synology Photos in DSM 7.

Moments vs Synology Photos

With DSM 7, Synology Photos replaced both Moments and Photo Station.

Synology Photos merges AI-based organization with folder-based control. It supports both personal and shared spaces, offering improved performance, better permission management, and unified indexing.

If you are still running DSM 6, Moments may still function effectively. However, future development focuses on Synology Photos. Understand the key differences between Synology Moments and Synology Photos.

When to Use Synology Moments

Moments is best suited for:

Personal photo libraries
Family backups
Users wanting Google Photos-style organization without cloud dependency
Privacy-focused individuals

It is less suited for professional photographers requiring advanced metadata workflows or teams needing structured collaboration.

Performance Considerations

For optimal performance, use a NAS model with:

A modern multi-core processor
At least 4GB RAM
SSD cache if managing large photo libraries

Regular indexing checks and storage health monitoring improve long-term stability.

About Epis Technology

Epis Technology assists businesses and professionals in designing optimized Synology storage environments for media management. The team evaluates hardware capability, indexing performance, backup integration, and storage architecture to ensure smooth photo processing and long-term protection. Whether migrating from Moments to Synology Photos or integrating media workflows into broader backup strategies, Epis Technology ensures secure deployment aligned with performance and compliance requirements.

Synology NAS as a Central Syslog Server Guide

Synology

Setting Up a Synology NAS as a Central Syslog Server

Centralized logging is no longer optional in modern IT environments. Firewalls, switches, VPN gateways, servers, and applications all generate logs, but if those logs remain isolated on individual devices, investigations and compliance reviews become difficult. A Synology NAS can serve as a reliable and cost-effective central syslog server, consolidating logs into a single, searchable platform.

When properly configured, this setup strengthens security monitoring, simplifies troubleshooting, and supports compliance reporting requirements.

Why Centralized Syslog Matters

Syslog is a standard protocol used by network devices and servers to send event messages to a centralized log collector. Instead of logging into each device separately, administrators can review activity in one place.

A centralized syslog server helps with:

Faster incident investigation
Correlating events across multiple systems
Detecting unusual activity patterns
Preserving logs outside the originating device
Meeting audit and retention requirements

If a firewall or server is compromised, local logs may be deleted. Forwarding logs to a Synology NAS protects against this risk by storing events independently.

Installing Log Center on Synology

Synology includes a built-in application called Log Center, which can function as a syslog server.

To begin:

Open DSM and navigate to Package Center.
Install Log Center.
Launch Log Center and enable the Syslog Server function.

Within settings, define the listening port, typically UDP 514, though TCP can also be enabled for more reliable log transmission.

You can specify which IP ranges are allowed to send logs to prevent unauthorized devices from injecting data.

Configuring Network Devices to Send Logs

Each device must be configured to forward logs to the Synology NAS IP address.

For example:

Firewalls: Set the syslog destination IP and port.
Managed switches: Enable remote logging under monitoring settings.
Linux servers: Modify rsyslog or syslog-ng configuration to forward logs.
VPN appliances: Configure log forwarding under security or system logging sections.

Always verify connectivity after configuration by checking Log Center for incoming events.

Organizing and Filtering Logs

Once logs begin arriving, organization becomes critical. Log Center allows administrators to create rules and filters that categorize events by severity, source IP, hostname, or keyword.

This makes it easier to separate:

Authentication events
Firewall denies
System errors
VPN activity
Application logs

Filters also enable alert triggers. For example, repeated failed login attempts can generate email notifications, helping teams respond faster.

Storage Planning and Retention

Central logging can consume significant storage over time. Before deploying syslog services at scale, calculate estimated daily log volume from connected devices.

In DSM, configure retention policies to:

Automatically delete logs older than a defined period
Archive logs to a separate volume
Export logs for long-term storage

If compliance requirements demand immutability, forward syslog data to a secondary storage repository or cloud archive in addition to keeping it locally.

Securing the Syslog Server

Because a syslog server contains sensitive operational data, security controls are essential.

Best practices include:

Restricting syslog source IP ranges
Using TCP with TLS if supported by sending devices
Limiting DSM administrative access
Enabling firewall rules on the NAS
Activating two-factor authentication for admin accounts

Treat the NAS as part of your security infrastructure, not just storage.

Correlating Logs for Better Monitoring

The real advantage of central syslog appears when correlating logs across systems.

For example:

A VPN login from an unfamiliar IP can be matched with file access logs on the NAS. Firewall blocks can be reviewed alongside authentication attempts. Docker container activity can be tracked against system performance metrics.

This correlation transforms raw log data into actionable insight.

Scaling Beyond Basic Syslog

For larger environments, Synology can forward collected logs to SIEM platforms or external monitoring tools. This layered approach keeps a local archive while allowing advanced analytics at scale.

Hybrid models, combining on-prem log collection with cloud-based analytics, are common in enterprise deployments.

About Epis Technology

Epis Technology designs centralized logging frameworks that integrate Synology NAS systems into broader security and compliance architectures. The team evaluates network topology, configures structured log flows, defines retention policies, and ensures secure segmentation between log sources and storage. By aligning syslog deployments with backup, access control, and monitoring strategies, businesses gain reliable audit trails and faster incident response without fragmented logging systems.

Compliance-Ready Log Retention for Synology & Hybrid IT

Synology

SOX, GDPR, and ISO Log Retention and Export Plans

If your company thinks logs are “nice to have,” audits will change that. Logs are proof for programs that follow SOX, GDPR, and ISO. They show who used the systems, what changed, when it happened, and how quickly you acted. The goal is not to keep all logs forever, but to keep the right logs long enough, make sure they can’t be changed, and send them to auditors in a way they can trust.

A clear scope is the first step in making a good plan. Pick the systems that are important for compliance. These are usually identity, authentication, storage access, backups, security controls, and administrator activity. Then, create pipelines for retention and export that keep the data safe and make it easy to get back.

Start with a “Log Inventory” that fits your level of risk

Most of the time, compliance fails because logs are missing or don’t match up between systems. Make a list that shows how each system is connected to the types of logs you need. This usually includes DSM login events, changes to privileges, access to shared folders, file services activity, VPN connections, and security events in Synology environments. You also need identity provider logs, firewall logs, endpoint security alerts, and cloud audit logs in hybrid environments.

After that, sort the logs by how they affect the business. Authentication and administrative actions are usually very valuable because they explain “how” something happened. Logs of file access and configuration changes are often the evidence needed to back up investigations and pass audit sampling.

Define Retention by Rules, Not by Guesswork

Retention is not just a choice about where to keep things; it’s also a choice about policy. SOX often makes companies keep records longer for systems that are used for financial reporting and makes it harder for people to access or change records. GDPR puts more pressure on you to limit the amount of personal data you keep and the reasons for keeping it. This means you shouldn’t keep personal data longer than you need to. Most ISO programs want you to define retention, show controls, and show that the process is always running.

Setting a baseline retention tier for all security and access logs is a good idea. Then, for systems that need to keep logs longer for financial controls or contractual reasons, you can increase the retention time. Your policy should make it clear what you keep, why you keep it, and how you delete it when the time limit is up.

Keep Integrity With Tamper Resistance

Integrity is important to auditors. The evidence chain is weak if an administrator can delete or change logs without anyone knowing. For Synology and other on-prem systems, the safest way to keep logs is to send them to a different system that has controls like immutability, write-once retention, or something similar. At the very least, keep logs off the device being audited so that a hacked admin account can’t erase the evidence.

Also, make sure that different people do different things. Not just the team that runs production systems should be able to delete or change log archives. You can still set up role-based access, approval workflows, and limited administrative access to the log store in smaller businesses.

Make sure that exports are always the same and easy to find

Exporting logs quickly and in a way that can be used is the most common audit pain. You will waste days during a review if your exports are done by hand, are not always the same, or require you to guess where logs are. Set up a way to export that works every time and includes the time range, system scope, and event types that are important.

The structure is important. Standardize the names of exported files, the time zones and timestamps, and keep a clear chain of custody. Keep exports with an index, like a summary record of which sources were used, when they were exported, and who the operator was. That list is your “audit map,” which you can use to show that everything is there.

Align with ISO 27001: Controls, Proof, and Repeatability

ISO programs reward processes that are well-organized. Just saying that you log events isn’t enough; you have to show that logging is turned on, being watched, being protected, and being looked at. Write down where logs are kept, how alerts are handled, and how incidents are reported. Keep proof that your organization’s retention policies are always in effect and that you can get proof when you need it.

This is where regular checks come in handy. Check on a regular basis that log forwarding is still working, that storage limits aren’t causing log loss, and that access controls are still correct after staff changes.

GDPR, Privacy, and Data Minimization

Logs can have personal information, IP addresses, usernames, device IDs, and sometimes file names. Designs that follow the GDPR should not include too much detail when it isn’t needed, and they should only let people who need to see logs do so. Retention should only be done for real security and compliance reasons, not “just in case.”

In some situations, redaction and pseudonymization are options, but they can’t make the investigation less useful. The right balance is to tightly control who can access data, only keep it for as long as necessary, and make sure that exports are safe.

Showing that you are following the rules during an incident

A strategy is only “compliant” if it still works when something goes wrong. You need logs the most when there is ransomware, credential theft, or insider risk, and that’s also when attackers try to delete them. Think about what could go wrong when you design by sending logs off-system, keeping them in secure locations, and keeping separate admin controls for the logging platform.

Include log retrieval drills in your tabletop exercises. Your process will fail under real pressure if the team can’t get identity logs, NAS access logs, and VPN logs in a short amount of time.

About Epis Technology

Epis Technology helps businesses set up logging and retention that meets real compliance needs in on-prem, Synology, and hybrid environments. This includes figuring out which log sources are best, setting up centralized collection, setting up protected retention, and making repeatable export workflows for audits and incident response. The method links logging to bigger goals for data protection, such as making sure backups are safe, making access control stronger, and keeping an eye on operations. This way, when compliance teams and auditors need evidence, they can trust it.

PTZ Cameras vs Fixed IP Cameras: Security Comparison

Synology

PTZ Cameras vs Fixed IP Cameras: Which Is Better for Security?

Modern surveillance systems rely heavily on IP cameras to monitor facilities, protect assets, and maintain operational safety. Among the many types of security cameras available, two of the most common are PTZ cameras and fixed IP cameras. Both offer valuable surveillance capabilities, but they serve different purposes depending on the environment and monitoring needs.

Understanding the differences between these camera types helps businesses design effective security systems that provide the right level of coverage, control, and reliability.

What Are PTZ Cameras?

PTZ stands for Pan, Tilt, and Zoom. A PTZ camera can move horizontally (pan), vertically (tilt), and zoom in or out to focus on specific areas.

Unlike fixed cameras that monitor a single direction, PTZ cameras can actively adjust their viewing angle. This allows operators to track moving objects, zoom into suspicious activity, or scan large areas from a single device.

PTZ cameras are often controlled remotely through surveillance software or security control rooms. Some models also support automated patrol patterns that move the camera across predefined zones.

Because of their flexibility, PTZ cameras are commonly used in environments where security teams need to monitor large or dynamic areas.

What Are Fixed IP Cameras?

A fixed IP camera is a stationary camera that monitors a specific location or viewing angle. Once installed, the camera continuously records the same field of view without moving.

These cameras are widely used in security systems because they are simple, reliable, and cost-effective. Fixed cameras typically provide constant monitoring of important areas such as entrances, hallways, offices, and storage rooms.

Many modern fixed cameras offer advanced features such as motion detection, night vision, and high-resolution video recording.

Because they always focus on the same area, fixed cameras provide consistent surveillance without requiring manual control.

Key Differences Between PTZ and Fixed Cameras

PTZ cameras and fixed IP cameras differ in several important ways.

Coverage flexibility is one of the most noticeable differences. PTZ cameras can move and zoom to cover large areas, while fixed cameras monitor only one specific direction.

Control capabilities also differ significantly. PTZ cameras can be controlled remotely, allowing security operators to adjust viewing angles in real time. Fixed cameras do not move once installed.

Monitoring style varies as well. PTZ cameras are often used for active monitoring where operators track events as they happen. Fixed cameras provide passive monitoring by continuously recording a designated area.

Another difference is cost and complexity. PTZ cameras are usually more expensive and require more configuration. Fixed cameras are simpler and often easier to deploy in large numbers.

Advantages of PTZ Cameras

PTZ cameras offer several advantages for security environments that require flexibility and real-time monitoring.

One major benefit is the ability to monitor large areas with fewer cameras. Because PTZ cameras can rotate and zoom, a single device can cover a wide space.

They also allow security personnel to focus on suspicious activity immediately. When an incident occurs, operators can zoom in to capture important details such as faces or license plates.

PTZ cameras are especially useful in locations such as parking lots, stadiums, large warehouses, and transportation hubs where wide coverage and active monitoring are necessary.

Advantages of Fixed IP Cameras

Fixed cameras remain the most widely used surveillance devices because they provide reliable and consistent monitoring.

One key advantage is continuous coverage of critical areas. Because the camera always points in the same direction, nothing in that field of view is missed.

Fixed cameras are also more affordable and easier to install, making them ideal for large deployments across offices, retail stores, and business facilities.

Another benefit is that they often produce higher image stability, since the camera does not move during recording.

For these reasons, fixed IP cameras are commonly used for entrances, hallways, cashier areas, and other locations where constant monitoring is required.

When to Use PTZ Cameras

PTZ cameras are best suited for environments that require flexible monitoring or wide coverage.

Typical use cases include:

Parking lots and large outdoor areas
Industrial facilities and warehouses
Stadiums or event venues
Transportation hubs
Security control centers

In these environments, the ability to track movement and zoom into specific areas can significantly improve surveillance effectiveness.

When to Use Fixed Cameras

Fixed IP cameras are ideal for locations that require consistent monitoring of specific areas.

Common use cases include:

Building entrances and exits
Retail stores and offices
Hallways and corridors
Storage rooms and warehouses
Reception and customer service areas

In many surveillance systems, fixed cameras are deployed throughout the building while PTZ cameras monitor larger exterior spaces.

Combining PTZ and Fixed Cameras in Enterprise Surveillance

Most enterprise surveillance systems combine both camera types to create a comprehensive monitoring solution.

Fixed cameras provide constant coverage of critical areas, ensuring that no activity goes unnoticed. PTZ cameras provide dynamic monitoring that allows security teams to track events and respond to incidents.

Together, these camera types create layered security coverage that improves situational awareness across facilities.

Synology NAS and IP Surveillance Systems

Modern surveillance deployments often integrate cameras with centralized storage platforms. Synology NAS systems provide a powerful surveillance platform through Synology Surveillance Station, which allows businesses to manage multiple cameras from a single interface.

Surveillance Station supports both PTZ and fixed cameras, enabling organizations to monitor live feeds, store video recordings securely, and receive alerts when motion or unusual activity occurs.

This centralized approach simplifies camera management while ensuring reliable storage for large volumes of video footage.

How Epis Technology

Epis Technology helps organizations build secure surveillance environments using IP cameras and Synology NAS storage systems. The company designs scalable surveillance architectures that combine high-resolution cameras, centralized video management, and reliable data storage.

Through services such as infrastructure deployment, surveillance system integration, and long-term data protection planning, Epis Technology helps businesses implement security platforms that protect facilities and operational assets.

VPN Protocols on Synology Compared

Synology

VPN Protocols on Synology: OpenVPN vs L2TP/IPsec vs WireGuard

Choosing the right VPN protocol on a Synology NAS affects security, performance, and ease of management. While Synology VPN Server traditionally supports OpenVPN and L2TP/IPsec, many administrators are also exploring WireGuard through Docker or third-party packages due to its speed and simplicity.

Each protocol has strengths and trade-offs. Understanding how they differ helps you deploy secure and reliable remote access without unnecessary complexity.

OpenVPN: Flexible and Widely Supported

OpenVPN is one of the most popular VPN protocols available on Synology. It supports strong encryption, flexible configuration options, and works across most operating systems.

One major advantage of OpenVPN is its ability to operate over UDP or TCP. UDP generally delivers better performance, while TCP may help in restrictive network environments. OpenVPN also supports certificate-based authentication, which strengthens identity verification.

However, configuration can be more complex. Administrators must manage certificates, export client profiles, and maintain port forwarding if the NAS is accessible externally. Performance is stable but not always the fastest option due to encryption overhead.

OpenVPN is often the best balance between compatibility and security for small businesses and advanced home networks.

L2TP/IPsec: Built-In Client Support

L2TP/IPsec is built into many operating systems, including Windows, macOS, iOS, and Android. This eliminates the need for separate client software.

On Synology, L2TP/IPsec is relatively easy to enable. It relies on a pre-shared key and user credentials for authentication. Because it is widely supported natively, it can be convenient for environments where installing additional software is restricted.

The downside is that L2TP/IPsec depends on multiple UDP ports, which may require careful firewall configuration. Some ISPs or restrictive networks block these ports, leading to connection failures. Additionally, while secure when configured correctly, it lacks the flexibility of certificate-based setups found in OpenVPN.

L2TP/IPsec works well for environments prioritizing ease of deployment over advanced customization.

WireGuard: Performance-Focused and Modern

WireGuard is newer than both OpenVPN and L2TP/IPsec. It is known for its lightweight design and high performance. With fewer lines of code and streamlined encryption mechanisms, WireGuard often delivers faster speeds and lower latency.

Synology does not natively include WireGuard in all VPN Server packages, but it can be deployed via Docker containers. This makes it attractive for advanced users comfortable managing container environments.

WireGuard configuration is simpler in many ways. It uses public and private key pairs instead of complex certificate chains. Performance advantages make it appealing for high-throughput environments or users with limited upload bandwidth.

The trade-off is official support. Because it is often deployed via Docker, troubleshooting may require deeper technical knowledge.

Security Considerations

All three protocols offer strong encryption when properly configured. The real difference lies in implementation and management.

OpenVPN offers robust security with certificate support. L2TP/IPsec provides built-in OS integration but requires careful firewall configuration. WireGuard delivers modern encryption with high efficiency but may require container management.

No matter which protocol is chosen, security best practices should include:

Strong passwords and unique user accounts
Two-factor authentication
Restricted firewall rules
Regular log monitoring
Updated DSM and packages

Protocol choice alone does not guarantee security. Proper configuration matters more.

Performance Comparison

In practical use, WireGuard often provides the highest throughput and lowest latency. OpenVPN offers stable performance but may consume more CPU resources on lower-end NAS models. L2TP/IPsec typically performs adequately but may struggle in restrictive network environments.

For heavy file transfers or remote editing workflows, performance differences can become noticeable. For general remote access, all three protocols are sufficient when configured properly.

Choosing the Right Protocol

The best protocol depends on your environment:

OpenVPN is ideal for flexibility and broad compatibility.
L2TP/IPsec suits environments requiring native client support.
WireGuard works best for performance-focused deployments and technically experienced administrators.

Evaluate network restrictions, client device requirements, and internal expertise before deciding.

About Epis Technology

Epis Technology helps organizations design secure VPN architectures aligned with their broader infrastructure strategy. The team evaluates protocol selection based on workload demands, firewall policies, and hybrid cloud integration. They configure secure authentication models, implement structured logging for monitoring, and ensure VPN access aligns with backup and business continuity frameworks. By integrating VPN deployment into a complete infrastructure plan, businesses gain stability and visibility rather than isolated remote access solutions.

Advanced Log Center Techniques on Synology

Synology

Advanced Log Center Techniques: Search, Archive, and Export

People often use Synology Log Center as a basic event viewer. Administrators open it to see if someone is trying to log in, if a firewall is blocking something, or if a VPN connection is working, and then they close it again. But Log Center is much more powerful than most people think. When set up correctly, it turns into a structured tool for monitoring, archiving, and auditing that helps with security investigations and compliance reporting.

To get the most out of Log Center, you need to do more than just look at logs. You need to use advanced search features, plan how long to keep logs, and set up secure export workflows.

Learning how to use Advanced Search and Filtering

Log Center has advanced filtering options that make it easy for administrators to find specific events. You can filter by service, severity level, user account, IP address, or time range instead of having to scroll through thousands of entries.

If you’re looking into repeated VPN login failures, for instance, filtering by the VPN Server service and the “warning” or “error” level will greatly narrow down the results. Adding a source IP filter can show whether the attempts came from one address or several areas.

When looking at incidents, filtering by time is very helpful. You can put together sequences of authentication events, permission changes, or firewall triggers by looking at activity that happened during a specific time frame, like a suspected breach period.

You can also look more closely with keyword-based searches. When you search for words like “authentication failed,” “blocked,” or “denied,” you quickly find patterns that look suspicious.

How to Analyze Faster with Saved Views

Making structured workflows around saved filters can save time in places that need to be watched all the time. Log Center isn’t a full SIEM platform, but it does let you filter by service and event type all the time. Making it a habit to check certain event categories makes sure that important alerts aren’t missed.

For instance, administrators can regularly check failed login attempts, changes to administrative accounts, and high-severity system warnings without having to make new filters each time.

Setting up strategies for log archiving

You can only use logs if you keep them in the right way. Logs can be deleted or rotated by default when they reach storage limits. To be ready for an audit, archiving must be done on purpose.

Administrators can set up retention policies in Log Center based on storage limits or time periods. How long you keep logs depends on rules, company policy, and how much space you have to store them.

Organizations that deal with sensitive data may need to keep records for longer periods of time. Archiving logs to an external NAS or secure storage repository protects old records and frees up space on the main storage.

It is also important to make sure that archived logs can’t be changed. Limiting access to Log Center and archived log folders stops people from changing them without permission.

Safe Log Export for Reporting and Compliance

Exporting logs is very important when doing audits, looking into incidents, or legal reviews. Log Center lets you export logs in structured formats that can be looked at by other people or brought into other tools for analysis.

Before exporting, use advanced filters to narrow the data set to only the events that matter. Exporting only the records that are needed makes it easier to review and keeps sensitive data that isn’t related safe.

Make sure that exported logs are sent safely when you share them. If logs are used for official investigations, make sure to encrypt files before sending them and keep records of who has them.

Sending Logs to Other Systems

Log Center does a great job of managing things internally, but some businesses find that sending logs to external monitoring platforms is helpful. Secure syslog forwarding lets you connect to enterprise SIEM systems for advanced analytics and long-term storage.

Forwarded logs let you connect different parts of your infrastructure, like firewalls, cloud services, and endpoint monitoring tools. This wider view makes security stronger and makes it easier to report on compliance.

Benefits of Monitoring That Are Specific to Synology

Log Center is part of Synology DSM, along with firewall rules, VPN services, account protection, and snapshot alerts. When logs are stored and can be searched, administrators can link failed login attempts to firewall blocks or system changes.

With this integration, Log Center can do more than just show you things; it can also be an operational intelligence platform in the storage environment.

About Epis Technology

Epis Technology helps businesses create structured logging frameworks that are better than the ones that come with the software. The team sets up advanced filtering methods, makes sure that retention policies are in line with compliance needs, and, when needed, adds Synology logs to larger monitoring systems. Businesses can always see what’s going on and be ready for an audit by using a single strategy that includes log archiving, VPN monitoring, firewall analysis, and hybrid cloud oversight.

Centralized Log Aggregation for Synology NAS

Synology

Putting together logs from more than one Synology NAS device

When businesses use more than one Synology NAS, it can be hard to see everything at once. Each device keeps its own logs of authentication, VPN activity, firewall events, file access history, and system warnings. Finding patterns in the environment is hard if those logs stay separate on each unit. When there is a security breach or a performance issue, administrators often waste a lot of time switching between systems to figure out what happened.

Centralized log aggregation gets rid of that waste of time. Organizations get a unified view of their operations by gathering logs from several Synology NAS devices into one monitoring point. Administrators can look at trends, link suspicious activity, and make reports all in one place instead of going through event histories that are all over the place.

Why Centralization Makes Security and Compliance Better

Most of the time, modern cyber threats don’t just affect one device. Automated tools often scan whole network ranges, which means that more than one NAS unit may get suspicious login attempts at the same time. This activity may seem random when logs are looked at one at a time. But when they are all together, patterns show up quickly. If you keep failing to log in to your VPN from different places, it could mean that someone is trying to stuff your credentials. If firewalls block traffic at the same time across branches, it could mean that probing is being coordinated.

Centralized logging is very important for compliance readiness, in addition to security detection. More and more, regulatory standards require detailed audit trails that show who accessed systems, when they did so, and what they did. Keeping logs on different devices makes it harder to report and manage retention. Aggregation makes it easier to keep records, speeds up the process of getting ready for an audit, and makes sure that the same retention policies are followed throughout the organization.

How to Use Synology Log Center as a Log Receiver

Log Center is a built-in feature of Synology that lets you store logs in one place. One NAS can be set up to receive logs from other NAS devices, which then send their logs to it. When forwarding is turned on, events like failed login attempts, VPN sessions, file changes, and firewall alerts all go to a single dashboard.

This setup lets admins filter logs by device, service, IP address, or time range without having to log into each NAS separately. It becomes much easier to connect events. For instance, if a VPN login fails and then a firewall automatically blocks it, it can be tracked right away across many systems.

All devices should use NTP synchronization to make sure they are all using the same time source. For meaningful analysis, timestamps must be consistent.

Sending Logs to Outside Monitoring Platforms

Sending logs to an external security platform may be better for companies with bigger networks or stricter compliance rules. Synology supports syslog forwarding, which can include sending data securely and encrypted. When organizations send logs to a centralized SIEM or monitoring platform, they get better correlation tools, longer retention options, and automated alerting workflows.

External platforms let you look at more than just NAS devices in more detail across a number of infrastructure components. For example, you can compare VPN activity on Synology with firewall logs, alerts for endpoint detection, and events for cloud authentication. This wider view makes it easier to find and respond to threats.

It’s important to protect the channels used to send logs outside of your network. Logs often have usernames, IP addresses, and other private data in them. Encryption keeps monitoring data safe while it’s being sent.

Benefits of Aggregated Logs for Business

Centralized logging makes security stronger and makes it easier to fix problems that happen all the time. If users say that their VPN connections drop out or they can’t access files, administrators can look at activity on all systems from one place. You don’t have to compare screenshots or export logs by hand anymore; the relevant data is now easy to find.

Aggregated logs can also help find problems with configuration. Centralized logs make it easier to confirm that a problem is systemic rather than isolated. For example, if a firmware update causes service errors on several NAS units, centralized logs make it easier to confirm that the problem is not just one unit.

The Integrated Monitoring Ecosystem from Synology

Log Center is built into Synology DSM along with firewall controls, VPN services, account protection tools, and system alerts. When logs are kept in one place, it is easier to check and validate these features. You can look at snapshot alerts, hardware warnings, authentication attempts, and administrative actions all at once.

This integration turns Synology from a basic storage device into a monitored part of the infrastructure. Centralized logging makes storage systems active parts of an organization’s security and operations monitoring system.

About Epis Technology

Epis Technology helps companies come up with structured ways to combine logs from multiple Synology environments. The team sets up secure log forwarding between NAS devices, connects logs to enterprise monitoring platforms when needed, and makes sure that retention policies follow compliance standards. Businesses can see everything that is going on in their operations instead of just seeing bits and pieces of event records by combining VPN activity monitoring, firewall event correlation, and hybrid cloud oversight into one monitoring strategy.

Fix L2TP/IPsec & OpenVPN Errors on Synology

Synology

Troubleshooting L2TP/IPsec & OpenVPN Failures Using VPN Logs

When a VPN connection fails, the issue is rarely random. Whether you are using L2TP/IPsec or OpenVPN on a Synology NAS, the logs almost always contain the answer. The key is knowing where to look and how to interpret what you see.

Instead of guessing at firewall settings or reinstalling clients, reviewing VPN logs provides precise insight into authentication errors, certificate mismatches, port blocks, or network issues.

Step 1: Locate the Correct Logs

Start with Log Center in DSM:

Open DSM
Go to Log Center
Filter by VPN Server

You can also review logs directly inside the VPN Server package under the Log tab. If necessary, enable detailed logging for deeper diagnostics.

Common L2TP/IPsec Failures and What the Logs Reveal

1- Authentication Failure

Log example:

authentication failed for user

Possible causes:

Incorrect username or password
Account disabled in DSM
User not granted VPN privileges

Fix:

Verify user credentials
Confirm VPN access permissions under Control Panel > User
Ensure account is not locked due to failed attempts

2- Pre-Shared Key Mismatch

Log example:

no shared key found

Possible causes:

Incorrect IPsec pre-shared key
Client using outdated configuration

Fix:

Re-enter the pre-shared key on both server and client
Avoid copying keys with hidden characters

3- Port Blocked (L2TP/IPsec)

Required ports:

UDP 500
UDP 1701
UDP 4500

Log example:

phase 1 negotiation failed

Possible causes:

Router not forwarding ports
ISP blocking UDP ports
Firewall rule preventing access

Fix:

Verify port forwarding
Check Synology firewall rules
Test connectivity from an external network

Common OpenVPN Failures and Log Analysis

1- TLS Handshake Failure

Log example:

TLS Error: TLS key negotiation failed

Possible causes:

Incorrect port forwarding (default 1194 UDP)
Firewall blocking traffic
Mismatched protocol (UDP vs TCP)

Fix:

Confirm OpenVPN port configuration
Verify router forwarding
Ensure client profile matches server protocol

2- Certificate Errors

Log example:

VERIFY ERROR: depth=0, certificate expired

Possible causes:

Expired server certificate
Expired client certificate
Incorrect time settings

Fix:

Renew certificates in DSM
Re-export new client configuration files
Ensure NAS system time is accurate

3- User Authentication Failure (OpenVPN)

Possible causes:

Incorrect credentials
User not enabled for OpenVPN
Account auto-blocked

Fix:

Confirm VPN permissions
Check auto-block list
Reset password if necessary

Correlating Logs for Faster Diagnosis

Do not rely on VPN logs alone. Cross-check:

Firewall logs
Account protection logs
System authentication logs

For example:

Multiple failed VPN attempts followed by IP auto-block
Successful login but immediate disconnect due to firewall rule

Log Center filters allow you to correlate these events quickly.

When Logs Show Nothing

If there are no logs:

Ensure detailed logging is enabled
Confirm VPN Server service is running
Check that traffic is reaching the NAS
Test from a different network

No log entry often means the traffic is blocked before it reaches the VPN service.

Best Practices for Preventing Recurring Failures

Use strong passwords and enable two-factor authentication
Keep DSM and VPN packages updated
Limit VPN access by IP where possible
Avoid exposing management ports directly
Monitor logs regularly

Proactive monitoring prevents repeated troubleshooting.

About Epis Technology

Epis Technology helps organizations design secure and stable VPN infrastructures on Synology systems. The team configures firewall rules, validates certificate management, aligns VPN access with directory permissions, and integrates monitoring frameworks for real-time visibility. By combining VPN deployment with structured backup and hybrid cloud strategies, businesses reduce recurring failures and improve remote access reliability.

Optimize Google Workspace Backups with Synology Tools

Synology

Using Synology NAS to make Google Workspace data safer

Some of the most important business information, like emails, shared files, contacts, and collaboration records, are stored in Google Workspace. A lot of businesses think that cloud platforms will keep this information safe forever. Cloud services really only care about making sure they are available, not about long-term backup retention or recovery guarantees.

Accidental deletion, ransomware that spreads through endpoints, actions by insiders, and retention limits can all permanently delete important data. As a result, more and more businesses are using separate backup systems to make sure they can get their data back. Synology NAS is a centralized solution made just for protecting SaaS. Learn about seamless secure access between Synology NAS and Google Workspace

Why Google Workspace Needs Backup

Google offers redundancy and uptime, but not full ownership of backups. It may be impossible to recover files that have been deleted after the retention period or by policy.

Businesses are at risk when employees leave and take shared folders with them, when files are overwritten with new ones, and when compliance rules require keeping historical records. These things will cause permanent loss if there is no independent backup.

A dedicated backup system makes sure that the organization, not the SaaS provider, is in charge of keeping and recovering data. View how to backup Google Workspace easily with Synology C2

An Overview of Synology Active Backup for Google Workspace

Synology Active Backup connects directly to Google Workspace and protects data all the time without needing agents on user devices. The system does incremental backups and uses deduplication to store versions in a way that saves space. See a comprehensive Google Workspace backup guide with Synology Active Backup

Administrators can use one management console to protect Gmail, Drive, Contacts, Calendar, and Shared Drives. Administrators or delegated users can start the recovery process right away without needing Google support tickets.

Storage Efficiency and Backup Architecture

Synology does incremental backups at the block level, which means that only changes are saved after the first backup. Storage use stays predictable even for big companies when combined with global deduplication.

You can set up retention policies for each department or by law. Companies may keep executive mailboxes longer than regular users or keep project folders forever.

Recovery and Keeping the Business Going

Synology makes Workspace much more resilient by adding recovery flexibility.

You can restore individual emails to their original accounts, export them, or put them in new accounts. You can get back whole user accounts that you accidentally deleted. You can get shared drives back to a previous state after ransomware encryption or sync corruption.

Self-service portals let employees get their own data back without needing IT help, which lowers the support load while keeping audit control.

Benefits for Security and Compliance

Independent backups make your cybersecurity stronger. Even if attackers get hold of credentials, it is not easy for them to delete backup copies that are stored on secure NAS volumes.

Synology also lets you protect snapshots and replicate them offsite, which means that Workspace backups will still be safe even if the infrastructure fails. This helps businesses meet rules that say they have to keep data and be able to get it back even if the SaaS provider doesn’t guarantee it. Understand about enterprise data classification to support backup compliance goals

Audit logs and centralized reporting give the visibility needed for compliance reviews.

Synology’s special features for protecting workspaces

Synology combines backups of workspaces with protection for the whole infrastructure. You can store backups of workstations, server images, and cloud archives on the same NAS. Explore a guide to Google Workspace backup with Synology

This unified architecture makes it easier to recover from disasters. If a company needs to rebuild its environment, it can restore both endpoints and SaaS data from a single platform.

Companies don’t want tools that are broken up or policies that don’t stay the same.

About Epis Technology

Designing Google Workspace backups correctly requires more than simply enabling a tool. Authentication scopes, retention rules, storage architecture, and restore validation must all be configured properly to ensure recoverability during real incidents.

Epis Technology deploys Synology backup environments as part of a complete data protection strategy. The team integrates Google Workspace backups with endpoint, server, and cloud protection, then verifies restore workflows through real recovery testing. Continuous monitoring and lifecycle management ensure backups remain compliant, operational, and ready for disaster recovery scenarios.

Controlling Administrator Access in Enterprise IT Environments

Synology

Why Privileged Access Is the Biggest Security Risk

Most breaches in businesses don’t start with malware anymore. They begin with real credentials.
Administrator accounts have direct control over backups, virtual machines, storage systems, and cloud data. When attackers get privileged access, they don’t have to break systems; they just log in.

Network storage platforms, virtualization hosts, backup servers, and SaaS management portals all need higher permissions to work. A single hacked admin account can delete backups, turn off alerts, encrypt storage, and hide activity logs.

Privileged Access Management (PAM) is a way to lower this risk by controlling who can access important systems, when they can do so, and what actions they can take.

What Privileged Access Management Really Does

PAM is more than just a place to store passwords. It is a full access governance system that makes sure people are responsible and can be audited.
A good PAM implementation adds identity verification, approval workflows, session recording, and automatic credential rotation. Access is no longer permanent; instead, it is temporary and can be tracked.
Users don’t know the passwords for administrators anymore. The system only adds credentials when it is told to. Every action is recorded and linked to a person.

This gets rid of shared accounts, stops silent abuse, and makes a verifiable audit trail that is needed for compliance and cyber insurance validation.

Important Parts of a Modern PAM Architecture

Access is linked to a person, not an account that everyone can use.
Directory integration makes sure that authentication works through centralized identity providers like Active Directory.

Privileges that are given at the right time

Users only have higher rights for a short time.
Permissions automatically end when the session is over.

Vaulting Credentials

Administrative credentials are kept safe and changed on their own.
Even IT workers never see production passwords directly.

Monitoring and Recording Sessions

All administrative sessions are recorded.
Security teams can look into changes to settings, deleted data, or strange behavior by replaying activity.

Workflows for Approval

Before doing sensitive things, you need permission.
For instance, getting permission from management may be necessary to restore backup archives or change retention policies.

Combining PAM with backup and storage systems

Enterprise storage infrastructure needs more integration than regular server access control. Backup platforms, NAS systems, and SaaS backup tools must all be part of PAM enforcement.

Storage administrators usually have full control over snapshots and retention policies. Without PAM, they could delete recovery points by mistake or on purpose.

A good architecture links PAM to the next systems:

Backup systems
Infrastructure for virtual machines
Consoles for managing NAS
Portals for cloud storage
Orchestration tools for disaster recovery

This makes sure that the controls for protecting data can’t be quietly bypassed.

Benefits of Auditing and Compliance

Regulatory frameworks are requiring more and more proof of access accountability. Because privileged users can change logs, logs alone are no longer enough.

PAM makes evidence that can’t be changed by recording activity outside of the target system. The audit record stays the same even if the storage logs are deleted.

Companies get:

Actions of the administrator that can be traced
Enforcing the separation of duties
Change history that has been checked
Being ready to report compliance

This makes audits for SOC 2, HIPAA, and cyber insurance a lot easier.

Lowering Operational Risk

PAM not only makes things more secure, but it also makes them more stable.

One of the most common reasons for downtime is making changes to the configuration by mistake. Administrators naturally follow standard procedures when every action is approved and recorded.

Because the system always shows exactly what changed and when, there are fewer emergencies and problems can be fixed more quickly.

How to Use PAM in a Synology-Based Infrastructure

PAM is very important in storage environments because NAS systems are often used as both backup targets and recovery platforms at the same time.

Administrative tasks like deleting snapshots, turning off replication, or changing user permissions should need extra verification and full logging.

Organizations protect the integrity of their backups and keep ransomware from attacking recovery repositories by using controlled sessions and automatic credential rotation.

About the company Epis Technology

Epis Technology helps businesses set up safe infrastructure with limited administrative access across storage, backup, and cloud platforms. The company builds enterprise backup systems, adds identity-based access controls, and sets up secure Synology environments with monitoring that is ready for audits. Epis Technology makes sure that important systems stay safe while keeping operations running smoothly and being ready for compliance through managed backup services and infrastructure consulting.