Detecting Intrusion Attempts in MikroTik Logs

Using MikroTik Logs for Intrusion Detection

RouterOS has a powerful logging system. By configuring it properly, you can detect intrusion attempts, unauthorized access, and suspicious activity — all from the router's own logs.

How RouterOS Logging Works

Logs are generated by topics and can be sent to multiple targets:

Memory (default, limited to ~150 entries)
Disk (flash storage — use sparingly on routers with limited flash)
Remote Syslog server (recommended for production)
Email

Setting Up Remote Syslog

Forward all logs to a central syslog server (e.g., running rsyslog or Graylog):

TEXT

/system logging action
add name=remote-syslog target=remote remote=192.168.88.200 remote-port=514 src-address=0.0.0.0 bsd-syslog=yes syslog-facility=local0

/system logging
add topics=info action=remote-syslog
add topics=warning action=remote-syslog
add topics=error action=remote-syslog
add topics=critical action=remote-syslog

Key Log Topics for Security

Topic	What It Shows
`system`	Login attempts, config changes
`account`	Successful and failed logins
`firewall`	Matched firewall rules
`manager`	Winbox session events
`pptp,l2tp,ipsec`	VPN connection events

Enable Firewall Rule Logging

Add log=yes and log-prefix to critical firewall rules:

TEXT

/ip firewall filter
add chain=input action=drop log=yes log-prefix="INPUT-DROP:" comment="Log all dropped input"
add chain=input src-address-list=ssh_blacklist protocol=tcp dst-port=22 action=drop log=yes log-prefix="SSH-BLACKLIST:"

Now every dropped packet generates a log entry.

Log Analysis: What to Look For

Failed login attempts:

TEXT

/log print where message~"login failure"

Output example:

TEXT

10:23:45 account,info: netadmin failed to log in from 1.2.3.4 via ssh

Firewall drops:

TEXT

/log print where message~"INPUT-DROP"

Winbox connection events:

TEXT

/log print where message~"winbox"

Configuration changes (very important):

TEXT

/log print where topics~"system"

This shows every config change — who made it, what was changed, when.

Detect Unauthorized Config Changes

Create a script that checks for new scripts, users, or scheduler entries:

TEXT

/system script
add name=sec-audit source={
    :local userCount [/user print count-only]
    :local scriptCount [/system script print count-only]
    :local schedCount [/system scheduler print count-only]
    /log info message="SEC-AUDIT: users=$userCount scripts=$scriptCount schedulers=$schedCount"
}

/system scheduler add name=sec-audit interval=15m on-event=sec-audit

If counts suddenly increase, investigate immediately.

Email Alerts on Critical Events

TEXT

/system logging action
add name=email-critical target=email email=admin@example.com

/system logging
add topics=critical action=email-critical
add topics=error action=email-critical

Configure email settings first:

TEXT

/tool e-mail set server=smtp.example.com port=587 from=router@example.com user=user password=pass

Log Firewall Hits by Address List

Log when an IP hits your brute force blacklist:

TEXT

/ip firewall filter
add chain=input src-address-list=ssh_blacklist protocol=tcp dst-port=22 action=drop log=yes log-prefix="BLACKLIST-HIT:"

Then monitor:

TEXT

/log print where message~"BLACKLIST-HIT"

Exporting Logs

For compliance or long-term analysis, export logs:

TEXT

/log print file=security-log

This writes the log to a file you can download via FTP or SCP.

Summary: Intrusion Detection Checklist

[ ] Remote syslog server configured
[ ] account and system topics forwarded to syslog
[ ] Firewall drop rules have log=yes
[ ] Email alerts for critical events
[ ] Regular log review scheduled
[ ] Baseline script monitoring unexpected config changes