Syslog overview & collection
A Xelynx log server ingests syslog from your routers and NAT gateways and stores it so you can search it and tie each connection back to a subscriber. It is built on VictoriaLogs: devices send syslog over UDP/TCP port 514, and the log store exposes an HTTP API and web UI on port 9428. In the CRM everything lives under RADIUS > Syslogs, which has three tabs — Syslogs, Servers and Setup Guide.
How collection works
Each log server keeps device logs for a rolling 90-day retention window. When a NAT or firewall log arrives, Xelynx reads the pre-translation source IP (and the source MAC when present) out of the message and matches it — bounded to the exact time of the log — against your RADIUS session history, so the connection is attributed to the subscriber who actually held that address at that moment. This is what makes the store lawful-intercept ready: a NAT record on its own is anonymous, but Xelynx resolves it to a named customer and their PPPoE login.
Adding a log server
Log servers are provisioned from your Xelynx account at portal.xelynx.com, not from inside the CRM. You supply the server's IP and its root SSH password; Xelynx hardens the box, installs the VictoriaLogs stack, opens ports 514 and 9428, generates its access credentials and registers it back to your CRM automatically. Once it appears under RADIUS > Syslogs > Servers, it is ready to receive logs.
Pointing devices at Xelynx
Open the Setup Guide tab. It shows the active server's address and pre-fills copy-paste snippets for your gear. For MikroTik, you add a remote logging action to the server's IP and port 514, enable firewall logging on it, and add a mangle or NAT rule that logs new connections — placed before your masquerade rule so the customer's pre-NAT source IP is captured. For Linux, you add an iptables LOG rule on POSTROUTING and forward kernel logs to the server with an rsyslog omfwd action. A final Verify Ingestion snippet queries the server's HTTP API to confirm logs are arriving. Once they are, head to searching logs, and see ownership & scope for who can see which server.