Centralized Synology NAS Logging with Wazuh: A Practical Integration Guide: Part 1

Learn how to forward Synology NAS logs to Wazuh using Syslog, configure centralized log collection, and visualize NAS activity through Wazuh dashboards.

INTRODUCTION

Network Attached Storage(NAS) devices are an important part of modern IT infrastructure. They store files, backups, and other critical data, making their availability and security important for any organization.

However, collecting logs dirctly from NAS can be incovenient when administrators need to monitor activities across multiple systems. Having logs available only on the device itself also makes centralized investigation and monitoring more difficult.

In this article, I will demonstrate how to integrate a Synology NAS with Wazuh to collect and visualize its logs from a centralized platform.

Environment and Tested Version

Wazuh manager IP192.168.1.133

NAS IP address192.168.1.170

NAS device: Synology DS423Plus

DSM Version: 7.2.2–72806

Wazuh Version: v4.14.4

Synology Log Center: 1.3.0–1667

Note: The NAS IP and Wazuh manager IP shown above are from my lab environment. Replace them with the addresses used in your own setup.

Cover Image

Phase 1: Configuring Syslog Forwarding on Synology DSM

Step 1: Open Log Center

1. Log in to Synology DSM using an administrator account.
2. Open Log Center.
3. Navigate to the log sending or log forwarding configuration.
4. Create a new log destination.

Step 2: Configure the remote Syslog server

• Server address:192.168.1.133
• Protocol: TCP
• Port:514
• Message format: BSD

Configuring the remote syslog destination in Synology Log Center.

Step 3: Select the logs to forward

• Click on [Control Panel] — [File Services]
• Check on [Enable Transfer Log]

Enabling file-transfer logging where required.

• Click on [Log Settings]
• Check for the logs you want to transfer

Selecting the event categories to forward.

Phase 2: Configuring Wazuh to Receive Syslog

Configuring the NAS destination is only one part of the integration. The Wazuh manager must also be configured to receive Syslog messages from the NAS.

Step 1: Configure the Syslog listener

On the Wazuh manager, open the configuration file:

sudo nano /var/ossec/etc/ossec.conf

Add the following configuration inside the existing ossec_config element:

<remote>
  <connection>syslog</connection>
  <port>514</port>
  <protocol>tcp</protocol>
  <allowed-ips>192.168.1.170</allowed-ips>
  <local_ip>192.168.1.133</local_ip>
</remote>

The configuration defines the Syslog listener as follows:

• <connection> specifies Syslog as the connection type.
• <port> specifies the port on which Wazuh receives messages.
• <protocol> defines TCP as the transport protocol.
• <allowed-ips> restricts accepted Syslog senders to the NAS IP address.
• <local_ip> specifies the local address on which the listener should operate.

The allowed-ips setting is required for the syslog listener. It provides source-IP filtering, but it does not encrypt syslog traffic or provide cryptographic sender authentication.

Security Consideration:

The syslog listener in this configuration uses TCP without TLS. Although TCP provides reliable transport, it does not encrypt the log messages or independently verify the sender’s identity.

Step 2: Restart Wazuh and verify the listener

sudo systemctl restart wazuh-manager

Next, verify that the Syslog port is listening:

sudo ss -tulnp | grep ':514'

Verifying the syslog listener on the Wazuh manager.

Phase 3: Verifying Incoming Syslog Messages

Before configuring archive storage or dashboards, I first verified that Syslog messages were reaching the Wazuh server.

Step 1: Capture Syslog traffic using tcpdump

Run the following command on the Wazuh server:

sudo tcpdump -ni ens160 host 192.168.1.170 and tcp port 514

• Replace <interface_name> with the network interface used by the Wazuh manager.
• This command captures TCP traffic between the NAS and the Wazuh manager on port 514.

Observing syslog traffic arriving from the NAS.

Step 2: Send a test log from Synology DSM

• Return to Log Center and use the Send test log function, if available in your installed version.
• Observe the tcpdump output and confirm that the NAS sends traffic to the configured destination.

Sending a test syslog message from Synology Log Center.

Step 3: Confirm that Wazuh receives the event

Get Rupesh Sharma’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

After confirming network traffic, check whether the event appears in the Wazuh manager’s archive file or another appropriate event output.

Testing receiving Logs from Synology Log Center to Wazuh Manager

Phase 4: Enabling Archived Log Collection

Wazuh distinguishes between events and security alerts.

• Events are the logs received and processed by Wazuh.
• Alerts are generated when events match detection rules that produce alerts at the configured severity threshold.
• Archives provide a way to retain and investigate events, including events that do not generate alerts.

Archive logging is useful when you want to inspect raw events, develop custom decoders, investigate activity, or create visualizations from a broader set of collected logs.

However, archive logging is optional. It is not required merely to receive syslog messages, and it is not a prerequisite for custom rules to generate alerts.

Step 1: Enable archive logging in Wazuh

Edit the Wazuh manager configuration:

sudo nano /var/ossec/etc/ossec.conf

• Locate the existing <global> section. Preserve its other settings and ensure the following options are configured as shown:

<global>
  <jsonout_output>yes</jsonout_output>
  <alerts_log>yes</alerts_log>
  <logall>no</logall> <!-- Currently set to no change it "yes" -->
  <logall_json>no</logall_json> <!-- Currently set to no change it "yes" -->

• Final config should look like this

<global>
  <jsonout_output>yes</jsonout_output>
  <alerts_log>yes</alerts_log>
  <logall>yes</logall>
  <logall_json>yes</logall_json>

Enabling JSON archive logging in the Wazuh manager configuration.

Why use logall_json?

• <logall_json>yes</logall_json> enables archival of events in JSON format. This is the relevant option for indexing archive events and visualizing them in the Wazuh Dashboard.
• <logall>yes</logall> enables a separate standard syslog-style archive output. Enable it only if you also require that format.

For this tutorial, JSON archives are sufficient for the indexing and visualization workflow. Enabling both options is not necessary just to build an archive data view.

Step 2: Enable archive forwarding in Filebeat

Enabling JSON archive logging creates the local archive data. To make those events available in the Wazuh Dashboard, Filebeat must also be configured to forward archives to the Indexer.

• Edit

sudo nano /etc/filebeat/filebeat.yml

Locate the existing Wazuh module configuration. Ensure that the relevant section resembles the following, preserving any other required settings in your file:

Enabling archive forwarding in Filebeat.

Step 3: Restart the services

sudo systemctl restart wazuh-manager # Restart wazhu Manager
sudo systemctl restart filebeat      # Restart filebeat

You can also test Filebeat’s output connectivity:

sudo filebeat test output

Testing filebeat connections

A successful output test confirms that Filebeat can connect to its configured destination. You should still verify that archive documents are being indexed.

Step 4: Verify archived events

Trigger [Send test log] from Synology NAS like phase 3, step 2.

On the Wazuh manager, run:

tail -f /var/ossec/logs/archives/archives.json |grep <NAS-IP>

Inspecting JSON archive events received from the Synology NAS.

Phase 5: Creating the Wazuh Archives Data View

With archive logging enabled, the next step is to access the collected events through the Wazuh dashboard.

Step 1: Open Index Patterns

1. Log in to your Wazuh Dashboard.
2. Open the left-side menu ☰.
3. Go to Dashboard Management → Index Patterns. Depending on the version, this may be called Data views.
4. Select Create index pattern or the equivalent option.

Creating a data view for archived events.

Step 2: Define the index pattern

Enter the following pattern:

Creating index pattern

Step 3: Select the correct time field

When the time-field dropdown appears, select timestamp, not @timestamp.

Selecting the timestamp field for the archive data view.

Step 4: Verify the data in Discover

Navigate to Discover and select the wazuh-archives-* data view.

• Filter using

location: "192.168.1.170"

Searching archived events from the Synology NAS.

Phase 6: Visualizing Synology NAS Activity

Searching individual events is useful for troubleshooting, but visualizations provide a more convenient way to observe activity over time.

Visualization 1: NAS events over time

This visualization provides an overview of the number of collected events during a selected period.

Create a line chart with the following configuration:

Data viewwazuh-archives-*

Metric: Count

X-axis Date histogram

Time fieldtimestamp

Filterlocation: "<Your NAS IP"

Dashboard

Visualization 2: Event distribution

A data table or bar chart can provide a breakdown of the collected events by a useful field, such as hostname, provided that the field exists in the index and supports aggregation.

Dashboard

Conclusion

In this implementation, I integrated a Synology DS423Plus NAS with Wazuh using Syslog over TCP, verified the incoming messages, enabled archived log collection, and created a dashboard for visualizing NAS activity.

The result is a centralized view of Synology logs that can support routine monitoring, troubleshooting, and further security analysis.

What’s Next: Part 2

In the second part of this series, I will focus on authentication monitoring.

I will create Wazuh decoders to extract relevant fields from Synology DSM login messages and define rules for successful and failed authentication attempts. I will then verify the resulting alerts and build dedicated visualizations for failed logins and their reported source IP addresses.