Synology can send syslog but I am not sure it can send DHCP server logs or not. Otherwise you might have to hack the box and do some modification. There are some info about how to do it if you find yourself on that path though. That will give you MAC and IP address. If you have SSO or some sort of log on and log off event logs somewhere, get them in Splunk to then you can correlate with IP address and user ID. Synology can be a proxy and LDAP server too I think. Cisco router logs can further provide the activities based on IP address once the above are done. These are my two cents. I hope these provide you some food for thought :-). ... View more