Synology DSM: send logs to MobiObs with Log Center

Before you start

The MobiObs device is 10.20.4.9 in the examples; use the address on its Network screen. Android does not let apps listen on ports below 1024, and MobiObs uses the same ports on every platform, so MobiObs receives syslog on udp/5514 and tcp/5514 rather than 514.

Sending logs to a syslog server is a feature of the Log Center package. If Log Sending is not in Log Center, install or update the package from Package Center. The steps match Synology’s current DSM 7 help. You need a DSM administrator account.

Log Sending

1. Open Log Center and go to Log Sending.
2. Tick Send logs to a syslog server.
3. Enter 10.20.4.9 in Server and 5514 in Port. The default is 514, so the port has to be changed.
4. Choose TCP or UDP in Transfer protocol. TCP does not lose messages in bursts; UDP needs no connection.
5. Choose BSD (RFC 3164) or IETF (RFC 5424) in Log format. MobiObs reads both; IETF carries a full timestamp with the year and time zone.
6. Click Send test log, check that it arrives (see below), then click Apply.

Leave Enable secure connection (TLS/SSL) off for MobiObs on tcp/5514. MobiObs can receive syslog over TLS on tcp/6514 when it is enabled in its Settings, but DSM then needs the certificate imported, which is rarely worth it for a short capture on a local network.

Choose which logs to send

The Filter tab of Log Sending limits what is sent, by category (for example system, connection or backup) or by severity (for example warning, error or information). For a short capture, send everything; for a NAS that logs a lot of file access, limit it to system and connection logs, or to warnings and above.

Useful things to watch for on a Synology NAS:

• Sign-in failures and blocked addresses in the connection logs, for example from a client with an old password or from repeated attempts from outside.
• Disk and volume warnings, such as a degraded storage pool or a drive health change.
• Backup and replication results, so you can see whether a nightly job finished, and when.
• Network changes, such as a link going down on one of the NAS ports.

What about SNMP?

DSM has an SNMP service (Control Panel > Terminal & SNMP > SNMP) for monitoring systems that poll the NAS, but Synology’s MIB guide states that DSM does not support SNMP traps. There is nothing to send to MobiObs on udp/1162. The events traps would carry, such as a disk failure, appear in the logs above.

Verify it works

• Logs. The Send test log message appears within a second or two with the NAS’s hostname. Filter Logs by that host to see only the NAS. For a real event, sign in to DSM with a wrong password once; the failed sign-in appears in the connection logs.
• Overview. Shows the NAS among the top hosts and its share of each severity, which makes a sudden run of warnings easy to see.
• Sources. Lists the NAS address with the last-seen time.

Troubleshooting

• The test log does not arrive. Check the port is 5514, then check that the NAS can reach the MobiObs device: a mobile device on guest Wi-Fi with client isolation cannot be reached from the LAN.
• The DSM firewall is on. It filters incoming connections; sending logs out is not normally affected, but check any rules you have added for outgoing traffic on a router between the two.
• TCP was selected and nothing arrives after the device moved. Click Send test log again once the MobiObs device is back on the network, so DSM reconnects.
• Timestamps look wrong. BSD format has no year or time zone; switch to IETF (RFC 5424).

Afterwards, untick Send logs to a syslog server and click Apply, or put the original server back if the NAS was already sending to one.