Adding Krontech Single Connect (Kron PAM) via Syslog

Updated October 12, 2026 08:15

Purpose

This guide explains how to forward Krontech Single Connect (Kron PAM) events to Logsign USO over syslog and what Logsign does with them. The integration covers the authentication, TACACS, session, command and event (audit) logs that Kron PAM sends through its syslog senders in CEF format.

Prerequisites

A Kron PAM administrator account that is allowed to change the syslog forwarding configuration.
Network connectivity from the Kron PAM instance to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
The Logsign user account that will add the data source needs access to Settings > Data Collection.

Step 1: Forward Kron PAM logs to Logsign

Kron PAM sends each log family through its own syslog sender (for example SyslogSenderForAuthLog, SyslogSenderForSessionLog and SyslogSenderForEventLog). Menu names differ between Kron PAM releases, so use the Krontech administration guide for your version to find the syslog settings. Add the IP address of the Logsign USO collector and the syslog port as the remote syslog server, and enable the senders for the log families you want to collect.

Keep the default CEF output and the RFC 5424 syslog header. Logsign reads the timestamp at the start of the header, and it expects that timestamp with milliseconds (for example 2026-09-24T13:21:16.941Z). Each event must reach Logsign as a single message.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select Krontech as the vendor and Single Connect as the product, and enter the IP address of the Kron PAM instance as the host. Click Save. Once Kron PAM starts sending, events appear under Search.

Supported message format

Logsign accepts two Kron PAM message layouts. Older Single Connect releases (2.x) put the fields inside braces with escaped equals signs, such as {userName\='jdoe', clientIp\='10.0.0.9', time\=2021-10-11 00:30:08.836}. Newer Kron PAM releases (3.x) send space separated key=value pairs with ISO 8601 times. Three typical events in the newer layout look like this (anonymized):

1 2025-11-25T13:44:52.116Z KronInstance SyslogSenderForAuthLog - - - CEF:0|KRONTECH|Kron PAM|3.6.0|100|AuthLog|10|dbId=5660598 id=2157198e-29d9-478b-9c09-238a848d66e0 time=2025-11-25T17:44:51.892Z event=2 eventSource=kcore-rest-api clientIp=10.10.2.92 tenantId=aioc params=null nasIp=127.0.0.1 nasHostname=127.0.0.1 userName=jdoe externalDirectorySource=null instanceName=KronInstance deviceGroupNames=Proxy

1 2026-09-24T13:21:16.941Z KRNMAIN01 SyslogSenderForSessionLog - - - CEF:0|KRONTECH|Kron PAM|3.8.1|100|SessionLog|10|sessionId=11111111-2222-3333-4444-555555555555 userName=jdoe host=10.0.0.5 hostName=host01 hostPort=3389 startTime=2026-09-24T14:11:43.216Z endTime=2026-09-24T14:31:04.101Z globalUserName=jdoe clientIp=10.0.0.9 instanceName=GRUP01 accessProtocol=RDP totalDuration=1160

1 2026-10-02T08:14:26.408Z KRNMAIN01 SyslogSenderForEventLog - - - CEF:0|KRONTECH|Kron PAM|3.8.1|100|EventLog|10|type=/session/disconnect/timeout userName=System clientIp=127.0.0.1 instanceName=KRNMAIN01 tenantId=aioc time=2026-10-02T11:14:24.787Z params={timeoutType\=idle, timeoutThreshold\=60, accessProtocol\=RDP}

The CEF event name (AuthLog, SessionLog, EventLog, CommandLog, TacacsLog and so on) becomes Event.Type and drives the event classification below. Key names are used exactly as Kron PAM writes them. Keys with the value null are skipped.

Notes and limits

Only the two EventLog types in the table have their own classification today. Other administrative actions, such as login and logout through the web console, password checkout or user changes, stay on System / Operation / Info. Use Event.SubType to filter them.
If session events show 1970-01-01 in Time.Start or Time.End, or the text {} in URL.Params, the appliance is running an older version of the Krontech Single Connect plugin. Contact Logsign support to confirm the version you need.
In the newer layout, the params={...} block is not written to a field. Its content stays in the raw log. An empty params={} block is ignored.
The event severity comes from the syslog priority of the incoming message, not from a field inside the Kron PAM event.
Keys such as hostPort, userId, idleDuration and remoteApplicationName are not mapped to a Logsign field. They stay in the raw log.

Verification

After both sides are saved, one login and one short session through Kron PAM are enough to check the integration end to end.

In Logsign USO, open Settings > Data Collection and confirm that the Krontech Single Connect source is receiving data.
Log in to Kron PAM to generate a test event. In Search, look for events with Vendor Krontech and Product Single Connect. The login should appear with Event.Type AuthLog and your user name in Source.UserName.
Open and close a session to a target. The SessionLog event should show the target in Destination.IP and real dates in Time.Start and Time.End.
If the source is receiving data but no events show Vendor Krontech, the messages are not in a format this integration recognizes. Check that Kron PAM sends CEF with an RFC 5424 header and a timestamp that includes milliseconds.