GUIDE — 2026-08-06

Synology DSM syslog forwarding to Mac

DSM's built-in Log Center is decent, but if you have more than one NAS, or you want unified alerting across your network gear and your NAS, forwarding syslog to a Mac receiver is the simplest way to consolidate. Here is exactly how.

What DSM logs you can actually forward

Synology's Log Center forwards these event streams to any external syslog server:

• System events (services starting, shutting down, package installs)
• Connection log (SMB, AFP, NFS, WebDAV, FTP connections)
• File Transfer log (uploads, downloads, deletes via various protocols)
• Backup logs (Hyper Backup, Snapshot Replication)
• Windows / macOS file service audit trail
• Security-related events (failed logins, IP blocks)

What you need

• Synology NAS running DSM 7.0+ (works on 6.2 as well, menus differ)
• Log Center package installed (Package Center → search "Log Center" → install if missing)
• A Mac at a stable IP
• SyslogWatch on the Mac

Step 1 — Give your Mac a reservation

Same as with other gear: set the Mac's IP so syslog does not stop when DHCP shuffles addresses. Do this either on your router or as a static IP on the Mac itself (System Settings → Network → Details → TCP/IP → Configure IPv4 → Manually).

Step 2 — Install SyslogWatch

Grab it from the Mac App Store. Launch and confirm it is listening on port 1514.

Step 3 — Enable Synology's syslog client

1. DSM → open Log Center
2. Left sidebar → Log Sending
3. Check Send logs to a syslog server
4. Fill in:
   • Server: your Mac's IP
   • Port: 1514
   • Transfer protocol: UDP (fast, fire and forget) or TCP (reliable, use if you notice missing events)
   • Format: BSD (RFC 3164) is the default and works well
5. Optional: enable Send logs securely if you configure TLS on the Mac side. For most homelab setups on a trusted LAN, skip this.
6. Under Log Type, check which streams to forward. Recommended starting set:
   • System
   • Connection
   • Windows / Mac / FTP file service
   • Backup
7. Apply

Step 4 — Verify

Force a small event. On the Mac, browse to your NAS in Finder and open a shared folder. Within a few seconds a "session opened" line should appear in SyslogWatch. If not:

• Confirm the Mac's firewall allows SyslogWatch (System Settings → Network → Firewall → Options)
• Try TCP transport instead of UDP if you are crossing subnets
• On the Mac: sudo tcpdump -i any -n port 1514 to confirm packets are landing

Step 5 — Filters for a NAS

• SYSTEM — package updates, service state changes, thermal events
• Failed to log in — brute force attempts on the web UI or SMB
• DSM — DSM-level events
• SMB — Windows file service activity
• Hyper Backup — backup job outcomes
• Btrfs — filesystem warnings
• The device's hostname (e.g. syno-01) — everything from a specific NAS if you have multiple

Step 6 — Alerts worth setting

With SyslogWatch Pro:

• Match "Failed to log in" three times within 5 minutes → sound + email (brute force underway)
• Match "Hyper Backup" AND ("failed" OR "error") → email (a backup broke)
• Match "Btrfs" AND ("checksum" OR "bad block") → email urgently (data integrity issue)
• Match "smart" AND "attribute" → email (drive attribute went to warning)
• Match "auto block" → sound alert (DSM's built-in brute-force blocker triggered)

What a DSM audit line looks like

2026-08-06T12:44:19+08:00 syno-01 Connection: User [alice] from [192.168.1.87] via [SMB] accessed shared folder [homes/alice/Documents].

You get who did what, from where, through which protocol, and to which resource. That is a big upgrade over DSM's per-user log rotation.

Common surprises

Not every DSM event is forwarded. Some packages (Surveillance Station, VPN Server, Container Manager) write to their own log files and do not automatically funnel into Log Center. Check each package's settings for its own remote-logging toggle.

TCP vs UDP. On a busy NAS with lots of Time Machine writes, UDP can silently drop lines. If you see gaps in the log stream, switch to TCP.

Timestamp offsets. Confirm the NAS timezone matches the Mac's under Control Panel → Regional Options → Time.

Next

Add your other devices to the same receiver — SyslogWatch tags every line with the sender's hostname so you can filter by device:

• UniFi → Mac
• pfSense → Mac

Get SyslogWatch — free tier is enough for a single NAS.