Sending SMX-RNS20 Logs to a Syslog / SIEM Server

Overview

From firmware 4.0 the SMX-RNS20 can forward its log to a syslog or SIEM server on your own network. Your security team then sees, in their own system, who logged into the device, who changed what, SSH logins, firmware updates and remote-access sessions.

• Off by default. Nothing leaves the device until you turn it on and name the server.
• Your server, your network. Nothing is sent to Simplinx.
• Standard format. RFC 5424 syslog with the device’s name as the hostname — any syslog collector or SIEM receives it without an agent.
• Outbound only. The device opens no port for this; it only sends.

Enabling the export

1. Log in to the SMX-RNS20 web interface.
2. Go to System → Log Export (Syslog).
3. Turn on Send logs to a syslog server and fill in the fields:

Field	What to enter
Server	Host name or IPv4 address of your syslog/SIEM server. A name is resolved when you save and the device’s firewall rule is written with that address — if the server’s IP changes later, save the page again
Port	514 by default; 6514 when TLS is selected
Protocol	UDP — simplest; messages are lost when the network is. TCP — messages are queued while the server is unreachable. TLS — as TCP, encrypted and server-verified
Server CA certificate (PEM)	Required for TLS: the certificate of the CA that signed your server’s certificate. The device verifies the server before sending; there is no unverified TLS option
Minimum severity	emerg … info. Messages at this severity and above are sent; info sends everything except debug. debug never leaves the device
Scope	Audit record only (default) or whole log — see below

4. Click Save.
5. Click Send a test message. One line with event=syslog.test reaches your server within seconds. The status box on the page shows whether the forwarding service is running, the device name used in messages, the resolved server address and the last error, if any.

The server may be on the machine side (LAN) or the IT side (WAN); the device reaches it over whichever interface routes to it. While the export is on, the device’s own firewall allows outbound traffic to exactly that address, port and protocol.

What is sent — scope

Scope	What arrives at your server
Audit record only (default)	Only the security-relevant programs: smx-rns-audit (the web interface’s audit events, below), sshd (SSH logins accepted and refused), sx-ota-client (firmware update check, install, commit, rollback) and sx-node (remote-access session start and end)
Whole log	Every message of the device from the chosen minimum severity up, the audit record included

For a SIEM the audit record is normally what you want. One filter on the program name smx-rns-audit finds every security event of the web interface.

Audit events

Every audit event is one line with key=value fields:

event=<name> result=ok|fail user=<name> src=<ip> detail=<...>

user is the web interface account, src the address the request came from. No password, key or setting value ever appears in a line — a settings change names the section that changed, not its contents.

Event	When
login	Login to the web interface, result=ok or result=fail
login.lockout	Too many failed logins; further attempts refused for a period
password.change	Admin password changed
settings.change	A settings section saved (detail=section=<name>)
firewall.change	Port forwarding or allowed-IP rules changed
config.export / config.import	Configuration backup downloaded or restored
settings.reset	Factory reset requested
update.check / update.install / update.commit / update.rollback	Firmware update action triggered from the interface
syslog.change	This export setting itself changed
syslog.test	Test message sent from the page
reboot	Reboot requested
time.change	Time, time zone or NTP settings changed

Two lines as they arrive at the server — a refused login and a WAN settings change:

<12>1 2026-10-09T18:25:17.356Z smx-rns smx-rns-audit - - - event=login result=fail user=admin src=192.168.1.5
<13>1 2026-10-09T18:26:02.010Z smx-rns smx-rns-audit - - - event=settings.change result=ok user=admin src=192.168.1.5 detail=section=wan

Time stamps come from NTP (the device’s own time service) or, without NTP, from the device’s real-time clock. Keep NTP configured under System → Date & Time so the lines line up with the rest of your SIEM.

TLS

Choose TLS when the server is not on a network you fully trust. The port changes to 6514 and the Server CA certificate field appears. Paste the PEM certificate of the CA that signed the server’s certificate; the device verifies the server against it and refuses to send otherwise.

Why enable it

The device keeps its log in memory (32 MB at most) and loses it at reboot. The syslog export is what gives you a durable record — the retention point is your server. If you need the audit history of the device, turn the export on and leave it on.

Note

The simplinx.net portal (Reports) records the remote-access connection history as seen from the Simplinx side — which user connected to which device, when and for how long. The device export records what happened on the device. The two complement each other.

Troubleshooting

Symptom	Check
Nothing arrives at the server	Is the server’s firewall open for the chosen port and protocol? Does the status box show Running and no Last error? With UDP, is the port correct — UDP gives no error when nothing is listening
Lines arrive, but with the wrong time	Configure NTP under System → Date & Time
The server was moved to a new IP	Open the page and Save again — the name is resolved at save time
TLS: the device does not send	The CA certificate must be the one that signed the server’s certificate, in PEM format. Check the Last error line in the status box