Log

This section covers log export and integration examples. Use it to forward RouterOS logs to external systems such as Elasticsearch.

RouterOS is capable of logging various system events and status information. Logs can be saved in router memory (RAM), disk, file, sent by email or even sent to a remote syslog server.

Video: Logging Basics

Log messages

Sub-menu: /log

All messages stored in router's local memory can be printed from the /log menu. Each entry contains time and date when the event occurred, topics that this message belongs to and the message itself.

[admin@MikroTik] /log> print 
1970-01-02 02:00:09 system,info router rebooted 
sep/15 09:54:33 system,info,account user admin logged in from 10.1.101.212 via winbox 
sep/15 12:33:18 system,info item added by admin 
sep/15 12:34:26 system,info mangle rule added by admin 
sep/15 12:34:29 system,info mangle rule moved by admin 
sep/15 12:35:34 system,info mangle rule changed by admin 
sep/15 12:42:14 system,info,account user admin logged in from 10.1.101.212 via telnet 
sep/15 12:42:55 system,info,account user admin logged out from 10.1.101.212 via telnet 
01:01:58 firewall,info input: in:ether1 out:(none), src-mac 00:21:29:6d:82:07, proto UDP, 
10.1.101.1:520->10.1.101.255:520, len 452

If logs are printed on the same date when the log entry was added, then only the time will be shown. In the example above you can see that the second message was added on sep/15 of the current year (year is not added) and the last message was added today so only the time is displayed.

Print command accepts several parameters that allow to detect new log entries, print only necessary messages and so on.

For example, the following command will print all log messages where one of the topics is info and will detect new log entries until <kbd>Control</kbd>+<kbd>C</kbd> is pressed.

[admin@MikroTik] /log > print follow where topics~".info"
12:52:24 script,info hello from script
-- Ctrl-C to quit.

In this example it will print only the dhcp info messages:

[admin@MikroTik] /log/print where topics~"dhcp.info"
11:42:32 dhcp,info defconf deassigned 192.168.88.37 for B0:E4:5C:27:EF:F2 Samsung
11:42:32 dhcp,info defconf assigned 192.168.88.37 for B0:E4:5C:27:EF:F2 Samsung

If print is in follow mode you can hit 'space' on the keyboard to insert a separator:

[admin@MikroTik] /log > print follow where topics~".info"
12:52:24 script,info hello from script

= = = = = = = = = = = = = = = = = = = = = = = = = = =

-- Ctrl-C to quit.

Logging configuration

Sub-menu: /system/logging

Actions

Sub-menu: /system/logging/action

Create separate memory logging buffers

Just like having different text files for different notes, these separate memory buffers allow you to direct specific types of log messages (based on topics) into distinct storage areas in memory.

• Isolation: Logs sent to buffer_A are completely separate from logs sent to buffer_B.
• Independent Viewing: You can view the contents of just one buffer at a time using /log/print where buffer=buffer_name.
• Targeted Clearing: You can clear the contents of one specific buffer using /system/logging/action/clear action=buffer_name without affecting the logs stored in any other memory buffer.

This provides much better organization and control over logs stored in memory, especially for debugging or monitoring, without mixing them all into the single default memory log.

Sub-menu: /system/logging/action/clear

Starting from 7.20_ab244, memory logs (target=memory) can be cleared with command: /system/logging/action/clear action=<logging action name>

Topics

Each log entry has a topic which describes the origin of the log message. There can be more than one topic assigned to the log message. For example, OSPF debug logs have four different topics: route, ospf, debug and raw.

11:11:43 route,ospf,debug SEND: Hello Packet 10.255.255.1 -> 224.0.0.5 on lo0 
11:11:43 route,ospf,debug,raw PACKET: 
11:11:43 route,ospf,debug,raw 02 01 00 2C 0A FF FF 03 00 00 00 00 E7 9B 00 00 
11:11:43 route,ospf,debug,raw 00 00 00 00 00 00 00 00 FF FF FF FF 00 0A 02 01 
11:11:43 route,ospf,debug,raw 00 00 00 28 0A FF FF 01 00 00 00 00 

List of Facility independent topics

Topics used by various RouterOS facilities

Examples

Create separate memory logging buffers

Create new memory logging buffers, which will store specified logs separately from default memory logs.

/system/logging/action/add name=dhcpMemoryLog target=memory memory-lines=300
/system/logging/action/add name=wirelessLog target=memory memory-lines=500

Assign topics to created buffers. This rule sends all DHCP logs to dhcpMemoryLog, and wireless logs to wirelessLog buffer.

/system/logging/add topics=dhcp action=dhcpMemoryLog
/system/logging/add topics=wireless action=wirelessLog

# View only DHCP related logs stored in its dedicated buffer
/log/print where buffer=dhcpMemoryLog

# View only non-info Wireless logs stored in its dedicated buffer
/log/print where buffer=wirelessLog

/system/logging/action/clear action=dhcpMemoryLog

Logging to file

To log everything to a file, add a new log action:

/system/logging/action/add name=file target=disk disk-file-name=log

and then make everything log using this new action:

/system/logging/add action=file

You can log only errors there by issuing the command:

/system/logging/add topics=error action=file 

This will log into files log.0.txt and log.1.txt.

You can specify the maximum size of the file in lines by specifying disk-lines-per-file. <file>.0.txt is the active file where new logs are going to be appended and once its size will reach the maximum it will become <file>.1.txt, and new empty <file>.0.txt will be created.

You can log into USB flashes or into MicroSD/CF (on Routerboards) by specifying its directory name before file name. For example, if you have accessible usb flash as usb1 directory under /files, you should issue the following command:

/system/logging/action/add name=usb target=disk disk-file-name=usb1/log

Warning Logging entries from files will be stored back in memory after reboot.