Monitor Agentless Devices in Wazuh with Syslog

To monitor agentless devices in Wazuh (routers, switches, NAS, firewalls), set up a Linux server with rsyslog as a Syslog Collector: the device sends its logs to port 514, rsyslog organizes them into files, and the Wazuh agent forwards them to the SIEM server.

Why do some devices need agentless monitoring?

Many critical pieces of infrastructure run on closed firmware where you simply cannot install a Wazuh agent: managed switches, routers, firewalls, NAS units and network printers. Leaving them unmonitored creates blind spots, because these are often the first devices an attacker probes. The Syslog protocol solves this: practically every network appliance can forward its logs over UDP or TCP port 514, so a single Linux collector running rsyslog can centralize events from dozens of agentless devices and feed them into Wazuh through one installed agent.

This architecture keeps the load off the appliances themselves and scales well: one collector can comfortably handle the syslog traffic of an entire branch office. Because rsyslog writes each source to its own file under /var/log/remote/, you preserve a clean separation between, say, firewall logs and NAS logs, which makes it far easier to write targeted Wazuh decoders and rules later on.

What does the architecture of the solution look like?

Agentless devices  -----> Linux + rsyslog -----> Wazuh Server
(routers, switches)       (Syslog Collector)     (SIEM)
        |                       |
    Port 514             /var/log/remote/

How do you install and configure rsyslog?

On the Linux server that will act as the collector, install rsyslog and enable the reception of remote logs.

# Install rsyslog
apt update && apt install rsyslog -y

# Edit /etc/rsyslog.conf and uncomment:
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

# Restart the service
systemctl restart rsyslog && systemctl enable rsyslog

How do you configure the firewall with iptables?

Allow connections to port 514 only from authorized devices for greater security.

# Allow from specific devices
iptables -A INPUT -p udp -s 192.168.1.1 --dport 514 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.1 --dport 514 -j ACCEPT

# Block everything else
iptables -A INPUT -p udp --dport 514 -j DROP
iptables -A INPUT -p tcp --dport 514 -j DROP

# Save the rules
apt install iptables-persistent -y && netfilter-persistent save

How do you organize logs with templates and filters?

Configure rsyslog to store logs in separate files based on their source (NAS, router, switch, etc.) using templates and IF filters.

# Templates for organized logs
$template NASLogs,"/var/log/remote/nas.log"
$template RouterLogs,"/var/log/remote/router.log"
$template LogFormat,"%TIMESTAMP% %HOSTNAME% %msg%\n"

# Conditional filters
if $fromhost-ip != '127.0.0.1' then {
    if $msg contains "NAS:" then {
        ?NASLogs;LogFormat
        stop
    }
    if $fromhost-ip == '192.168.1.1' then {
        ?RouterLogs;LogFormat
        stop
    }
}

How do you integrate the syslog logs with Wazuh?

Add the new log files to the Wazuh agent so it monitors them and forwards them to the SIEM server.

# Edit /var/ossec/etc/ossec.conf
# Add inside <ossec_config>:

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/remote/nas.log</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/remote/router.log</location>
</localfile>

# Restart the agent
systemctl restart wazuh-agent

What does the full log flow look like?

Which devices are compatible with this method?

• Routers: Cisco, MikroTik, Ubiquiti
• Switches: HP, Dell, Cisco
• Firewalls: pfSense, FortiGate, OPNsense
• NAS: Synology, QNAP, TrueNAS
• Network printers with syslog support
• IoT devices and legacy systems

Frequently Asked Questions

Why can't you install a Wazuh agent on a router or switch?

Network appliances, NAS units and firewalls run closed firmware where you cannot install third-party software like the Wazuh agent. Instead they support the Syslog protocol, so they forward their logs over the network to a collector that the Wazuh agent then reads.

Which port does Syslog use to receive logs?

Syslog uses port 514, over UDP by default and optionally over TCP for more reliable delivery. In this setup rsyslog listens on port 514 with both imudp and imtcp modules enabled, and the firewall should allow it only from authorized device IPs.

What is rsyslog's role in monitoring agentless devices?

rsyslog acts as a Syslog Collector on a Linux server: it receives logs on port 514, applies templates and IF filters to separate them by source, and writes them into organized files under /var/log/remote/. The local Wazuh agent then monitors those files and forwards events to the SIEM server.

How do I make Wazuh read the collected syslog files?

Add a localfile block in /var/ossec/etc/ossec.conf for each remote log file (for example /var/log/remote/router.log) with log_format syslog, then restart the agent with systemctl restart wazuh-agent so it begins forwarding those events.

Which devices can be monitored without an agent?

Any device with syslog support: routers (Cisco, MikroTik, Ubiquiti), switches (HP, Dell, Cisco), firewalls (pfSense, FortiGate, OPNsense), NAS units (Synology, QNAP, TrueNAS), network printers, and IoT or legacy systems.

Related articles:

• Creating Custom Decoders in Wazuh
• Log Flow: Decoders, Rules and Alerts
• How to Install the Wazuh Agent on Linux