Well, found a way to get everything i wanted with some wiring. Add prefixes for every log severity defined in https://help.mikrotik.com/docs/display/ROS/Log In reality there are only 5 that are useful: info, warning, error, critical, debug For every one define a prefix in this format: <pri> host pri...

Not even the BSD-on rfc3164 is correct. https://www.rfc-editor.org/rfc/rfc3164.html BSD-on: "<30>Apr 11 14:17:05 HOST user admin logged in from 192.168.2.3 via winbox" BSD-off: "system,info,account user admin logged in from 192.168.2.3 via winbox" Mickrotik Syslog 3164 is missing...