Purpose
This guide explains how to connect Peplink InControl2 to Logsign USO so that device bandwidth usage statistics for your Peplink and Pepwave routers are pulled in through the InControl2 REST API for reporting and analytics purposes.
Before you start, it is important to understand exactly what this integration collects. It reports periodic bandwidth usage per device (how many bytes a router transferred over a given interval), tagged as an informational "Pepwave Bandwidth Usage" event. It does not collect firewall rules, VPN events, admin logins, configuration changes, or any other security or audit event from the router. If you need those, Peplink Balance routers can forward their own log stream over syslog directly to Logsign USO, using the standard Peplink Balance log format; that is a separate, syslog-based collection method and is not covered by this guide.
InControl2 is Peplink's cloud (or privately hosted) management platform for Peplink and Pepwave SD-WAN devices. This integration talks to InControl2 itself, not to an individual router, so all of your organization's devices under InControl2 can be reported through a single configured source.
Prerequisites
You need an InControl2 user account (email and password) that can see the organization and the device groups you want usage data for, and the numeric Organization ID of that organization in InControl2.
Use least privilege. This integration only ever reads data; it never changes device configuration. Do not reuse an existing administrator's personal login for it. Instead, create a separate InControl2 account dedicated to Logsign and assign it the Organization Viewer role at the organization level, rather than Organization Administrator or Group Administrator. The Viewer role can see dashboards, reports, and device details across all groups in the organization, but cannot make any configuration changes, which matches exactly what this integration needs. The precise wording of this role in your own InControl2 console (menu labels can vary slightly between InControl2 versions) has not been verified against a live tenant for this guide; confirm it under Organization Settings before assuming an exact match.
Note that this account is a regular InControl2 login, not an OAuth2 Client ID/Secret pair. Peplink's officially published InControl2 REST API documentation describes an OAuth2 client-credentials flow for third-party integrations; this Logsign integration does not use that flow. It authenticates the same way the InControl2 web console itself does (an email/password sign-in that establishes a session), then calls the same underlying REST endpoints the console uses internally. Functionally this reaches the same organization/group/device/usage data, but it means there is no separate API key to generate or rotate, and no OAuth scope to restrict beyond the account's own role.
Step 1: Identify Your InControl2 Base URL
If your organization uses the shared InControl2 cloud service, your base URL is https://incontrol2.peplink.com. If your organization instead runs a privately hosted InControl2 appliance (ICVA, sometimes offered as "Privately Hosted InControl2"), your base URL is your own appliance's address instead, for example https://ic2.yourcompany.com.
There is no fixed regional list of InControl2 addresses to choose from the way some SaaS vendors publish one. There is a single shared cloud address for InControl2 SaaS customers, and a customer-specific address for privately hosted deployments. Confirm which case applies to you before continuing.
Enter the full address including the https:// prefix, with no trailing slash (correct: https://incontrol2.peplink.com, incorrect: https://incontrol2.peplink.com/). This is the opposite convention from some other Logsign integrations that ask for a bare hostname; here the poller builds every request by directly prefixing this value, so a missing scheme or an extra trailing slash will break every call it makes, starting with the very first sign-in request.
Step 2: Find Your Organization ID
In the InControl2 console, open Organization Settings for the organization whose devices you want to report. The numeric Organization ID is used internally by InControl2's REST endpoints to scope every request to that organization. The exact console screen that displays this ID was not independently verified against a live InControl2 tenant for this guide; if it is not immediately visible under Organization Settings, InControl2 support can confirm it for your account.
Step 3: Create a Dedicated Account for Logsign
- In the InControl2 console, go to Organization Settings and open the Users section.
- Add a new user with an email address dedicated to this integration (for example, a shared mailbox rather than a named employee's personal address, so the integration keeps working if that employee leaves).
- Assign the Organization Viewer role so the account can see all groups and devices in the organization without any edit rights.
- Complete the invitation flow and set a password for the account. Store the email and password securely; you will hand them to Logsign in the next step.
Step 4: Configure the Integration in Logsign USO
This integration does not currently appear as a self-service option in Logsign USO's standard "Add Data Source" screen. Provide the values below to your Logsign contact so the data source can be configured on your behalf:
| Field | Value |
|---|---|
| Base URL | Your InControl2 address from Step 1, for example https://incontrol2.peplink.com |
| Organization ID | The numeric Organization ID from Step 2 |
| Username | The email address of the dedicated account from Step 3 |
| Password | The password for that account |
| Host | A label (IP address or hostname) used to identify this data source inside Logsign; it is not used to reach InControl2, so any consistent value your team recognizes is fine |
| Description / Group | Standard Logsign source metadata used to organize this source among your other data sources |
| EPS | The events-per-second pacing limit applied when Logsign forwards collected usage records; this throttles how fast Logsign sends data internally and is unrelated to any rate limit on InControl2's side |
Once configured, Logsign signs in to InControl2 with the account from Step 3, retrieves the list of device groups and devices under your organization, and then queries each device's bandwidth usage for the current day. Every non-zero usage data point is sent to Logsign as a "Pepwave Bandwidth Usage" event carrying the device's name, serial number, product name, network name, and the byte count reported for that interval.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| No data arrives, no visible error | The sign-in step failed (wrong email/password, disabled account, or InControl2's login page changed in a way that breaks the integration's CSRF token handling), but the poller does not raise a distinct authentication error back to Logsign USO; it silently continues and the following data calls then fail or return nothing usable. | Re-check the Username and Password against Step 3, confirm the account can log in to the InControl2 console directly with those same credentials, and ask Logsign support to check the poller's own logs for this source for stack traces or non-JSON responses. |
| 403-style access denied on organization or group data | The dedicated account exists but was not granted access to this organization, or was granted access to only some of its groups. | In InControl2, confirm the account has the Organization Viewer role at the organization level (not just on a subset of groups), and that the Organization ID entered in Step 2 matches the organization the account belongs to. |
| 429 Too Many Requests / calls start failing mid-cycle | Peplink's published InControl2 REST API documentation states a limit of 20 API requests per second per organization, after which InControl2 returns 429. Organizations with a very large number of groups and devices can approach this limit because the integration queries usage per device sequentially. Whether this exact limit also applies to the session-based calls this integration makes (as opposed to the officially documented OAuth2 REST API) has not been independently verified. | If this happens consistently, contact Logsign support; the current implementation does not automatically back off and retry a rate-limited request within the same poll cycle. |
| Usage numbers look duplicated across consecutive polls | The integration does not keep a saved cursor or last-seen position. On every poll cycle it re-reads the current day's usage figures for every device and resends any non-zero value it sees, rather than tracking which values were already sent. | This is expected behavior with the current implementation rather than a misconfiguration. If exact, non-duplicated totals are required, discuss deduplication options with Logsign support before relying on this data for billing or capacity reporting. |
Notes and Limits
- This integration reports device bandwidth usage only. It is not a source of firewall, VPN, authentication, or configuration-change events. For those, use syslog forwarding directly from the Peplink Balance router, which is a separate collection method from this API integration.
- As of this writing, there is no self-service configuration screen for this integration in Logsign USO; setting it up requires providing the values in Step 4 to Logsign support so the data source can be created on the backend.
- Authentication is a standard InControl2 account sign-in (email and password establishing a session), not Peplink's officially documented OAuth2 client-credentials REST API. If Peplink changes the structure of its console login page, this integration could stop working until it is updated; this is a platform-side risk, not something a customer configuration change can fix.
- The integration does not verify InControl2's TLS certificate when connecting. This is convenient for privately hosted InControl2 appliances that may use a self-signed certificate, but it also means certificate validation is skipped even against the shared cloud service. This is a property of the current implementation, not a setting you can change from the configuration fields above.
- Every poll cycle re-reads the current day's totals rather than tracking previously sent values; see the Troubleshooting table above for the practical effect of this.
- Pagination of very large organizations (many groups or many devices per group) is not handled explicitly by the current implementation; it assumes each group/device listing call returns the complete list in a single response.