Skip to content

17. Log Export (Centralized Logging)

NTPSense can forward its Users Activity audit log — login/logout, every configuration change, and every access attempt blocked by role permissions — to an external syslog server or SIEM in real time. This is a security best practice: even if a gateway were ever fully compromised, an attacker cannot erase what has already been forwarded elsewhere.

This guide covers enabling log export, choosing a protocol, and verifying that your SIEM is genuinely receiving events.

1. Prerequisites

  • NTPSense CE or Pro, logged in as an Administrator
  • A syslog server or SIEM reachable from the gateway on your chosen port (default UDP/514)
  • Network/firewall rules allowing outbound traffic from the gateway to that server on that port

2. Relationship to the Local Audit Log

Log Export is an addition, not a replacement, for the local Users Activity log under System Logs > Users Activity, which is separately protected with cryptographic hash-chaining (each entry records the previous entry's hash, so tampering with the local log is detectable — see that page's Verify chain integrity button). Log Export gives you a second, off-box copy of the same events for cases where the local copy alone would not be enough — for example, a fully compromised gateway.

3. Enabling Log Export

Open System > Log Export.

  1. Check Enable log export.
  2. Enter the Server address of your syslog server or SIEM (hostname or IP).
  3. Enter the Port your server listens on (default 514).
  4. Choose the Protocol — UDP (default, simplest, no delivery confirmation) or TCP (more reliable, holds a connection open).
  5. Click Save.

⚠️ No TLS/encryption in transit yet. This feature uses plain UDP or TCP syslog (RFC 3164/5424) — the traffic is not encrypted between the gateway and your server. If your SIEM or compliance requirements mandate encrypted log transport, route this traffic through a TLS-terminating relay on the receiving side (e.g. syslog-ng or stunnel) rather than pointing NTPSense directly at your SIEM's TLS listener. Native TLS forwarding from NTPSense itself is not yet built.

4. What Gets Sent

Only Users Activity audit events are forwarded — login/logout, configuration changes, blocked access attempts, and update/rollback actions from the Security & Updates page. General OS/service logs are not included in this release.

Each forwarded message is the full JSON audit entry, including its hash and prev_hash fields from the local tamper-evident chain — so if your SIEM retains these, you can independently confirm that what it received matches what the gateway's own chain protects.

5. Verifying Your SIEM Is Receiving Events

If you don't yet have your SIEM's ingestion confirmed, a quick manual test from any Linux/FreeBSD/macOS machine that can reach the configured port:

nc -ul <port>

(for UDP; drop -u for TCP), run before or shortly after saving your Log Export settings. Then, on the gateway, perform any action that generates an audit event (e.g. log out and back in). You should see a line appear in the listener's output, beginning with a standard syslog header and containing the full JSON audit entry.

If nothing appears:

  • Confirm the server address and port are correct and reachable (check firewall rules on both ends).
  • Confirm Enable log export is checked and you clicked Save.
  • Re-open the Log Export tab — if the settings did not save, an error message will be shown.

6. Disabling Log Export

Uncheck Enable log export and click Save. Forwarding stops immediately; the local Users Activity log and its hash-chain are unaffected.

Updated by Halik Sahbana.