Skip to content

Sending logs from MikroTik

This guide completes Sending logs to the panel for MikroTik routers and switches with RouterOS 7. The values to enter (address and port) are on the page of the device in the panel, already filled in: below they are written as <Address> and <port in clear>.

1. What the panel receives

With the model MikroTik the panel reads the logs and shows them in the Events section of the Analysis page and in the reports:

In the Events section Where it comes from
Sign ins succeeded and failed The sign ins of every service (Winbox, SSH, web interface, API), with user and address
Administration The changes to the configuration, with who made them, from where and the command
Firewall blocked and Traffic allowed The firewall rules with logging on, with addresses, ports and interface (see chapter 4)

All the other logs can still be searched in the Logs tile.

The MikroTik sends in UDP to the port in clear.

2. Adding the MikroTik in the panel

  1. On the Devices page, Add a device.
  2. Category Router and firewall (or Switch and access point for a MikroTik switch), model MikroTik.
  3. Name of the device: a name for you, for example "Office router".
  4. Recognized by: IP address, with the fixed public address the MikroTik goes out to the Internet from. If the address changes, see chapter 6.
  5. Add and show the instructions.

The page of the device shows the commands below already filled in with your Address and your port, with the button to copy them.

3. Sending the logs

Open the terminal of the MikroTik: in Winbox New Terminal, or over SSH. Paste the commands of the page of the device; they look like this:

/system logging action add name=esapanel target=remote remote=<Address> remote-port=<port in clear> remote-log-format=syslog
/system logging add topics=info action=esapanel
/system logging add topics=warning action=esapanel
/system logging add topics=error action=esapanel
/system logging add topics=critical action=esapanel
  • The first command creates the destination: the server with its Address (RouterOS takes only an IP address here, not a name) and the port of the subscription, in syslog format with date and timezone.
  • The others send to that destination the informational messages, warnings, errors and critical ones: they include sign ins, changes and the firewall logs.

If RouterOS answers that remote-log-format does not exist, your version does not have this option: run the first command again without remote-log-format=syslog. The panel reads the default format too.

The same settings are in Winbox under System › Logging: Actions tab for the destination, Rules tab for the topics.

4. Firewall rules

RouterOS logs a firewall rule only if logging is on for it, and the log line does not say whether the packet was accepted or dropped. So:

  1. In IP › Firewall › Filter Rules open the rule you want to see.
  2. Action tab: tick Log and write a Log Prefix that contains the action, for example DROP-WAN for a rule that drops, ACCEPT-VPN for one that accepts. The panel understands the outcome from these words: drop, reject, block, deny (blocked) and accept, allow, pass (allowed), upper or lower case.
  3. General tab: for a rule that accepts, set Connection State to new, so only the start of each connection is logged. Without it, every packet becomes a line and the logs grow very fast.
  4. OK.

A rule with logging but without one of those words in its prefix shows up among the Firewall logs, without an outcome.

Turn logging on only for the rules that count: usually those that drop traffic from the Internet and those that let services or VPNs in.

5. Checking that the logs arrive

  1. Create an event: for example a sign in to Winbox or over SSH with a wrong password, then the right one.
  2. On the page of the device, Last log shows the time of the log just arrived.
  3. In the Logs tile search the logs of the device: the failed sign in is there.
  4. After a few minutes the Analysis page shows the failed sign in in the Events section, among the failed Sign ins.

6. Common problems

Nothing arrives

  • Check the Quarantine: if the logs arrive from an address different from the one entered (for example a router with two Internet connections), they are there. Authorize the address lets them in.
  • Check in System › Logging › Actions that the esapanel destination has the Address and the port in clear of your subscription.
  • The firewall rules in the output chain of the MikroTik, or a firewall upstream, must let UDP pass towards <Address> on <port in clear>.

The MikroTik has an address that changes

Recognize the MikroTik by its Device name instead of its address. In syslog format the name in the logs is the identity of the MikroTik (System › Identity), MikroTik from the factory: give each device an identity of its own before using it in the panel. In the default format there is no name: then the IP address or a DNS name is needed.

Too many logs

  • Check that the rules that accept have Connection State new.
  • Remove logging from the rules that see a lot of traffic and that you do not need.