Community discussions

MikroTik App
 
sw0rdf1sh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 50
Joined: Sun Nov 28, 2010 6:16 pm

Log issues

Wed Apr 13, 2011 3:51 pm

I am using script to send the log lines through tool/e-mail in a rb433ah.

If you use a script like the one in the wiki sending the log lines (be aware that I am saying LINEs and not FILEs) to an e-mail you can be in trouble if there is a flood attack (filling many lines in the log) or (the simplest case) if a user losses the signal all the time and simply filling many lines in the log.
This script also clears the log stored in memory from line 65000 to line 0 and back at 65000.

This is causing tool/e-mail stop working and memory of the routerboard going up and up.Also through winbox log window is very unstable (I'm not sure if I am describing it correct).

Is the solution storing the log to disk rather than memory?
Is the solution a script to check if tool/e-mail was succesfull and if not to clear completelly the log to free the memory?
Or is the solution lowering the huge log ammount of 65000 lines to something smaller?

Any ideas on that can help me more than enough.
Thanx
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7195
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: Log issues

Wed Apr 13, 2011 3:53 pm

Best solution is to have remote syslog server. You can also save Logs to file and periodically send those files by email.
 
sw0rdf1sh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 50
Joined: Sun Nov 28, 2010 6:16 pm

Re: Log issues

Thu Apr 14, 2011 2:23 am

Best solution is to have remote syslog server. You can also save Logs to file and periodically send those files by email.
Thanx for the reply mrz.Syslog server is indead the best solution. As a temporary solution I will try storing to disk in files and not to memory.
 
bburley
Frequent Visitor
Frequent Visitor
Posts: 80
Joined: Thu Nov 18, 2010 7:22 am
Location: Alberta, Canada

Re: Log issues

Thu Apr 14, 2011 3:56 am

Are you logging the activity of sending the log entries by email? If you are, this will cause an endless loop. Any log entries generated by emailing should be stopped with a filter rule that accepts the packets before they reach your logging rule.