How to Choose Law No. 5651 Logging Software?
The core criteria when choosing Law No. 5651 logging software are: syslog collection from all device brands, timestamped/e-signed retention via the authorized certification authority (TÜBİTAK Kamu SM), captive-portal user authentication (SMS/form/Turkish ID/sponsor), the ability to match NAT/DHCP records to identity, automatic rotation and encrypted archiving, audit-ready search/export, and easy setup/maintenance. The right software is not one that merely piles up logs; it is the product that can tie a record to a person, prove its integrity and quickly produce a report during an audit. The table below is a checklist you can use when deciding.
This page is for information only; consult the current legislation and a legal advisor for definitive obligations.
Comparison: what to look for?
| Criterion | Why it matters | What to look for |
|---|---|---|
| Device compatibility | Different brand firewalls/switches/APs | syslog from FortiGate, Cisco, MikroTik, Sophos, SonicWall, Palo Alto, etc. |
| Signature / timestamp | Evidential value of the record | TÜBİTAK Kamu SM integration; signing with server certificate when no credit |
| User identification | Binding a record to a person | Captive portal with SMS, form, Turkish ID, sponsor verification |
| Matching | Public IP:port → person chain | Correlating NAT + DHCP + portal records |
| Retention & integrity | Legal period + immutability | Automatic rotation, encrypted archive, retention management |
| Audit reporting | Speed when a request arrives | Fast search, filtered queries, export |
| Setup & maintenance | Total cost | Ready virtual appliance (VMware/Hyper-V), fast setup |
| KVKK compliance | Personal-data responsibility | Purpose-limited data, access control, encryption |
Common selection mistakes
- Buying a tool that only “piles up logs”: without signing/matching, a record is not evidence.
- A single-brand-locked solution: as your network grows, other brands are added.
- Skipping the captive portal: without authentication you cannot reach the person.
- Ignoring time synchronization: without NTP the records won’t match.
How does SignLogger meet these criteria?
SignLogger brings all of the above together on one platform: syslog collection from all brands, daily automatic signing of logs with the TÜBİTAK Kamu SM timestamp and e-signature, captive portal with SMS/form/Turkish ID/sponsor verification, NAT/DHCP matching, automatic rotation and audit reporting. It installs as a VMware/Hyper-V image; typical setup is ~30 minutes. For the general obligation see Law No. 5651 log obligation, and for sector examples see the hotels and cafes/restaurants guides. Explore the features or request a demo.
Frequently Asked Questions
Is an open-source syslog server enough for Law No. 5651?
On its own, usually not. It can collect logs, but signing/timestamping, user identification and matching are not built in to most open-source tools; you would have to add them separately.
Should I host it in the cloud or on my own server?
Both are possible; what matters is that records are signed, integrity-protected and access-controlled. SignLogger is a virtual appliance installed on your own infrastructure.
Do I need a separate service for timestamping?
In Türkiye, timestamps are obtained via the authorized certification authority (TÜBİTAK Kamu SM) and require credit. In SignLogger you define your own Kamu SM details during integration; without credit, signing continues with the server certificate.
I have different device brands — are they all supported?
SignLogger collects syslog brand-independently; it works with FortiGate, Cisco, MikroTik, Sophos, SonicWall, Palo Alto and others.
How much workload do setup and maintenance require?
As a ready virtual appliance, setup is completed the same day in most environments; updates and maintenance are managed from one panel.
Do KVKK and Law No. 5651 conflict?
No; Law No. 5651 requires certain records to be kept, while KVKK requires them to be processed purpose-limited, securely and time-bounded. A good solution meets both.