Logging in MikroTik: System Logs and Remote Syslog

System Logging in RouterOS

Logging is critical for troubleshooting, security auditing, and understanding what is happening on your network. RouterOS has a flexible logging system that can send logs to multiple destinations simultaneously.

Understanding the Logging System

RouterOS logging works with two components:

• Log topics: Categories of events (e.g., firewall, dhcp, system, interface).
• Log actions: Where to send the log messages (memory, disk, console, email, remote syslog).

Viewing Logs

The simplest way to see logs is:

/log print

To follow logs in real time:

/log print follow

To filter by topic:

/log print where topics~"firewall"

Configuring Log Actions

By default, RouterOS has four built-in log actions:

• memory: Stores logs in RAM (lost on reboot). Default for most events.
• disk: Stores logs in flash storage. Survives reboots but wears flash.
• echo: Prints to the console terminal.
• remote: Sends logs to a syslog server.

View existing actions:

/system logging action print

Configuring Memory Action

/system logging action set memory memory-lines=1000

This keeps the last 1000 log lines in memory.

Configuring Disk Action

/system logging action set disk disk-lines-per-file=1000 disk-file-count=5 disk-file-name=router-log

This creates up to 5 rotating log files with 1000 lines each.

Sending Logs to a Remote Syslog Server

This is the most important feature for any serious network. Sending logs to a central syslog server means:

• Logs survive router reboots or crashes.
• You can correlate logs from multiple devices.
• Logs are harder for an attacker to tamper with.

Step 1: Configure the Remote Action

/system logging action add name=remote-syslog target=remote remote=192.168.1.100 remote-port=514 syslog-facility=local0 syslog-severity=auto bsd-syslog=no

Parameters:

• remote: IP of your syslog server (e.g., a Linux box running rsyslog or syslog-ng).
• remote-port: Default syslog port is 514 (UDP).
• syslog-facility: The syslog facility code (local0 through local7 are commonly used for network devices).
• bsd-syslog: Set to yes for RFC 3164 (older) format, no for RFC 5424 (newer).

Step 2: Add Logging Rules to Use the Remote Action

/system logging add topics=firewall action=remote-syslog
/system logging add topics=system action=remote-syslog
/system logging add topics=critical action=remote-syslog
/system logging add topics=warning action=remote-syslog
/system logging add topics=info action=remote-syslog

Step 3: Verify

Check that log entries are appearing on your syslog server. On a Linux syslog server:

tail -f /var/log/syslog | grep <router-ip>

What to Log and Why

Not all log topics are equally useful. Here is a guide:

Avoid logging debug in production — it generates enormous volume and fills logs quickly.

Configuring Log Topics

View current logging rules:

/system logging print

Add a logging rule for DHCP events going to memory and syslog:

/system logging add topics=dhcp action=memory
/system logging add topics=dhcp action=remote-syslog

Remove a logging rule:

/system logging remove [find topics="dhcp"]

Log Prefixes

You can add a prefix to log messages for easier filtering:

/system logging add topics=firewall action=remote-syslog prefix="FW:"

Logging Firewall Events

To log specific firewall events, add the log action and a log-prefix to your firewall rules:

/ip firewall filter add chain=input action=drop in-interface=pppoe-out1 log=yes log-prefix="WAN-DROP:"

These events will appear in the log under the firewall topic.

Summary

• View logs with /log print and /log print follow.
• Configure actions with /system logging action.
• Send logs to a remote syslog server for persistence and centralization.
• Log firewall, system, critical, warning, and info at minimum.
• Avoid debug logging in production.
• Add log prefixes for easier searching.