What is a Syslog on my router?

Question

I have a D-Link DIR-615 hooked up to my Virgin Superhub and when I access the router settings, go to Maintenance then Log Settings. I notice that you can save some kind of log to a hard drive, server or by email.

Does a Syslog save all the websites you've visited in the past?, also under Log Type & Level, System, Firewall & Security and Router Status are checked, does that mean that my Mum or Dad are able to see what websites I've visited?

Answer 1

Syslog just logs system events. What counts as a system event depends on what software is running on the system and what log level it is set to. Almost anything could be included if the software was configured to include it. The easiest way to get some idea of what's included in the log is to read it.



Routers don't normally save a list of websites visited, partly because they don't have much memory in which to store the list, and partly because it requires packet inspection, which is a non-trivial addition to a home router in terms of the hardware requirements it brings about.



What the router often will do is keep a list of IP addresses that connections have been made to. The list will be relatively short, only keeping a record of the most recent connections. If you know how to, you can use reverse-DNS to look up whether there is a specific website associated with an IP address. But, if you start up something peer-to-peer, like BitTorrent or Spotify that opens lots of connections, or simply open lots of web pages (or the same one over and over), the list of connections will be replaced with a whole new list of connections in pretty short-order.



That doesn't mean your parents aren't monitoring what websites you are visiting, but it does mean it's unlikely they are doing it via the router. More feasible methods include getting the ISP to do it or running a monitoring program on another computer on the same network, though both of these are only likely if your parents don't trust you online.

Answer 2

Typically syslog on a router would log the router booting, possibly computers that it gives an IP address to (but more often only wireless connections, not wired), and incoming network traffic that the firewall blocks. As mentioned, they have limited memory, so they do not usually log all outgoing connections or replies to that that they let through, only what they block.



Of course if they have access to your computer and can look at your browsing history, that is another matter. At one time my sister helped her friend set up internet access, and her friend stumbled on browser history that my sister helped her how to figure out. Her sons had started web searching things like computer and console games, and then went to a porno site that they said was accidental. But browser history showed that they spent 2 hours there.

Answer 3

syslog (system log) is a Unix standard for logging information, either on one computer or from one to another. It's often used as a common standard on network equipment, too. You need a syslog server configured to accept remote logs.



It's good practice to log events to a different computer; that way, if your computer is hacked and the log wiped, you may still have evidence of who did it.



Exactly what a D-link router logs, I don't know. I would expect reboots, admin logins, configuration changes. It is configurable, but the manual does not give details. I doubt that syslog would include detailed traffic monitoring, but it may. You should be able to tell from the drop-down lists, or by trying it.

There is however a monitor page which gives details of current connections.