Synology NAS as a Central Syslog Server Guide
Setting Up a Synology NAS as a Central Syslog Server
Centralized logging is no longer optional in modern IT environments. Firewalls, switches, VPN gateways, servers, and applications all generate logs, but if those logs remain isolated on individual devices, investigations and compliance reviews become difficult. A Synology NAS can serve as a reliable and cost-effective central syslog server, consolidating logs into a single, searchable platform.
When properly configured, this setup strengthens security monitoring, simplifies troubleshooting, and supports compliance reporting requirements.
Why Centralized Syslog Matters
Syslog is a standard protocol used by network devices and servers to send event messages to a centralized log collector. Instead of logging into each device separately, administrators can review activity in one place.
A centralized syslog server helps with:
Faster incident investigation
Correlating events across multiple systems
Detecting unusual activity patterns
Preserving logs outside the originating device
Meeting audit and retention requirements
If a firewall or server is compromised, local logs may be deleted. Forwarding logs to a Synology NAS protects against this risk by storing events independently.
Installing Log Center on Synology
Synology includes a built-in application called Log Center, which can function as a syslog server.
To begin:
Open DSM and navigate to Package Center.
Install Log Center.
Launch Log Center and enable the Syslog Server function.
Within settings, define the listening port, typically UDP 514, though TCP can also be enabled for more reliable log transmission.
You can specify which IP ranges are allowed to send logs to prevent unauthorized devices from injecting data.
Configuring Network Devices to Send Logs
Each device must be configured to forward logs to the Synology NAS IP address.
For example:
Firewalls: Set the syslog destination IP and port.
Managed switches: Enable remote logging under monitoring settings.
Linux servers: Modify rsyslog or syslog-ng configuration to forward logs.
VPN appliances: Configure log forwarding under security or system logging sections.
Always verify connectivity after configuration by checking Log Center for incoming events.
Organizing and Filtering Logs
Once logs begin arriving, organization becomes critical. Log Center allows administrators to create rules and filters that categorize events by severity, source IP, hostname, or keyword.
This makes it easier to separate:
Authentication events
Firewall denies
System errors
VPN activity
Application logs
Filters also enable alert triggers. For example, repeated failed login attempts can generate email notifications, helping teams respond faster.
Storage Planning and Retention
Central logging can consume significant storage over time. Before deploying syslog services at scale, calculate estimated daily log volume from connected devices.
In DSM, configure retention policies to:
Automatically delete logs older than a defined period
Archive logs to a separate volume
Export logs for long-term storage
If compliance requirements demand immutability, forward syslog data to a secondary storage repository or cloud archive in addition to keeping it locally.
Securing the Syslog Server
Because a syslog server contains sensitive operational data, security controls are essential.
Best practices include:
Restricting syslog source IP ranges
Using TCP with TLS if supported by sending devices
Limiting DSM administrative access
Enabling firewall rules on the NAS
Activating two-factor authentication for admin accounts
Treat the NAS as part of your security infrastructure, not just storage.
Correlating Logs for Better Monitoring
The real advantage of central syslog appears when correlating logs across systems.
For example:
A VPN login from an unfamiliar IP can be matched with file access logs on the NAS. Firewall blocks can be reviewed alongside authentication attempts. Docker container activity can be tracked against system performance metrics.
This correlation transforms raw log data into actionable insight.
Scaling Beyond Basic Syslog
For larger environments, Synology can forward collected logs to SIEM platforms or external monitoring tools. This layered approach keeps a local archive while allowing advanced analytics at scale.
Hybrid models, combining on-prem log collection with cloud-based analytics, are common in enterprise deployments.
About Epis Technology
Epis Technology designs centralized logging frameworks that integrate Synology NAS systems into broader security and compliance architectures. The team evaluates network topology, configures structured log flows, defines retention policies, and ensures secure segmentation between log sources and storage. By aligning syslog deployments with backup, access control, and monitoring strategies, businesses gain reliable audit trails and faster incident response without fragmented logging systems.