Logging / syslog management on MikroTik

[Tomas]

A small script you can use to standardize logging / syslog configuration across all your RouterOS devices. The aim is to drop this script into a Config Push preset and be able to push it to your entire network at any time (or on schedule) to make sure logging configuration is the same across the entire network. This script is idempotent (as much as possible on RouterOS) - it won't cause any issues if ran multiple times, or if some rules it declares already exist.

Code: Select all

:do {
  :local topics {"account"; "critical"; "error"}
  :local ident [/system identity get name]

  /system logging
  remove [find action=sendToSyslog prefix=$ident]

  :foreach t in=$topics do={
    add topics=$t action=sendToSyslog prefix=$ident
  }
} on-error={
  :put "Failed to apply logging config!"
}

You can add additional topics you want to log into the "topics" array and you can remove the "prefix=$ident" part if you don't want to use a prefix for your syslog messages.

The above code doesn't configure the "sendToSyslog" action, that can be achieved using something like this:

Code: Select all

:do {
  :local syslogServer "1.2.3.4"

  /system logging action
  remove [find target=remote remote=$syslogServer]
  add name=sendToSyslog remote=$syslogServer target=remote
  
  /system logging
  remove [find invalid]
} on-error={
  :put "Failed to apply logging config!"
}

Finally, a few things to consider if using this config snippet:
1) It takes the approach of wiping all "action=sendToSyslog prefix=$ident" rules before running - if you are not OK with this, please modify as desired.
2) Due to the previous point, it should only be used if you want to manage all logging rules with "action=sendToSyslog prefix=$ident", if some other rules exist than specificed in the "topics" variable, they will not be retained.