I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends over time. Its supposed to provide intrusion detection as well as health monitoring.

After evaluating many Syslog Windows agents, I have not yet found a single freeware agent that supports TCP over HTTPS (while the Synology server does support it). They're almost all hardcoded to UDP port 514 (well, I can change the port on some, but I don't consider that helpful).

Since I'm planning to send converted windows eventlog messages over, I don't feel comfortable sending them unencrypted (they can contain full stacktraces and stuff like that).

I have looked into ways to limit the risk, and the only thing I can find is setting up the firewall to limit the sending of Syslog messages to my IP address. For SNMP the firewall can be limited to only accept requests from my client. An alternative is a commercial product with some hacks (which I'm not feeling really comfertable with).

The strange thing is that it seems like UDP 514 is the standard and even recommended looking at the answers in this thread, just like SNMP.

Am I too careful? It seems like the rest of the world has no problem with UDP? Do hosting providers of VPS servers prevent sniffing software on the internal (virtual) network? Or is it just safe to use UDP after all?

  • There is an answer here for secure syslog messages over internet.
    – AdnanG
    Aug 19, 2013 at 10:21
  • 3
    VPN between the sites? That would encrypt the tunnel and provide point-to-point security.
    – schroeder
    Aug 19, 2013 at 14:40
  • I got it working with a VPN, had to set up a scheduled task that would check the status of the VPN and reconnect if disconnected every hour or so. Sep 19, 2013 at 18:39

2 Answers 2


You have a few options:

  1. First one that comes to mind is creating an SSH tunnel from your Windows Server to your Syslog Server and sending your syslogs to localhost:1514 which would tunnel to logserver:514. This would encrypt your Syslog data in an SSH tunnel. You can do this several ways, like a batch script on startup to invoke PuTTy, like this http://howto.ccs.neu.edu/howto/windows/ssh-port-tunneling-with-putty/

  2. Secondly, which is what I do, is use a tool like Logstash to receive syslogs and read log files locally, and set up an output over HTTPS. Logstash requires Java Runtime, but is very powerful, uses very little resources, and is extremely customizable.

  3. You can pay for syslog-ng professional which will do TCP over 514 and you can apply TLS/SSL to it.


You can use OSSEC agent which is an open source host based intrusion detection agent that not only can monitor log files but have an extensive list of rules for detecting other attacks such as port scanning and reconnaissance. You have to configure a separate server for the OSSEC agent on your network and then transfer the alerts from the OSSEC server to your syslog server. The reason for the separate server is because OSSEC encrypts all the traffic using the blowfish encryption algorithm and the OSSEC server needs to first decrypt the traffic before transferring it to the syslog server. All the traffic can be securely transferred from your VPS to your network using open source solution that have an active mailing list support as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .