MikroTik

Hi all,
i'm trying to setup my main router to show the total logging of all my ros devices (mainly access points).
On all my access-points i've configured the logging as remote, pointing to the ip-address of my main router.
But i'm missing the part on how to allow this remote logging as input on my main router, I cannot find any settings related to this on the wiki/manual, and apperantly it doesn't work 'by default'.
The logs are no longer visible on each of the access-point, but also my main router is not showing any of the log messages from the access-points.
What setting do I need to change on my main router to enable the log input from all the access-points ?
Thanks,
Herman

If I get what you're asking, it doesn't. You need something that will function as a Syslog Server. Lots of them available from very simple to very complex.

Yes, indeed I think I need something like a syslog server.
I've been trying this with the Dude, and then I can send the logs of all my routers/access-points to the Dude, but I don't like so much the way these logs can be viewed on the Dude.
I would rather have my main router function as the syslog server and that it receives all logs of al the access-points in my network, the log-viewer of ROS is good enough for my needs and I like it.
Is there some kind of syslog server package or so available that I can install on my main router ?

You have a RouterOS box that supports containers ?
Then you could deploy such a container and collect logs. Offcourse you need to store them somewhere, so at least some external USB would be a good idea...unless these are really few logs.
This is not a fancy (web)GUI where you can browser through, it generates files based on the config you do (eg. 1 file for each AP etc,etc)

https://hub.docker.com/r/balabit/syslog-ng/

Yes, something like that might be an option, but that would still not bring all logging from my different ros devices into the one log of my main router.
But thanks for the pointer, I will think a bit further on how to configure it to my liking.

Yes, something like that might be an option, but that would still not bring all logging from my different ros devices into the one log of my main router.
But thanks for the pointer, I will think a bit further on how to configure it to my liking.

Offcourse it would ? All you ROS devices then simply point their "remote syslog" towards your Mikrotik that runs the container.
Ahh, you mean the "Log" window that you see with Winbox for example ?? And with real-time scrolling etc as the events are coming in ??
b]That is not possible indeed.[/b]

This may be wrong for the current dude versions, but it used to use the underlying logging system of the Mikrotik.

So all the logs were on the mikrotik, viewable in winbox.
If logging to file for persistence you would likely need external storage and multiple files specified.

oh, if that is possible that would be great, so it would be something like this:

• dude: enable the syslog-server on port 514
  dude: have logs send to ros where it's running on (in my case rb5009 router with external flash-drive attached)
  ros: have logs from dude stored on usb-disk and viewable via winbox system/log

To be honest I tried setting it up like listed above, but failed any suggestions about the specific config needed to get that running ?

What I have works, but it was setup quite a while ago, so there maybe something I have missed here.
Now In dude:

In Notifications section
Add a Notification
Call it "log to syslog"
It is of type log
log prefix=syslog

Schedule should be active all the time
Advanced, sorry not sure, doesn't really seem relevant.

In Settings (Server Configuration) /Syslog Tab
Enabled
Port 514
Add an entry
Action=accept Notification="log to syslog"

# testing
In winbox, system logging
change rule with script topic (created above) to action=dudeSyslog
then
With luck you should get 2 messages in log again,
but now one message should be dude, event, and have syslog: prefix in front of it.

Change script rule action back to dudeLog (or disable it)

Edit: Also need to firewall rule to allow udp port 514 input.

With Splunk you can get and graph all the logging you like. Free for up to 500MB logg/day.
See my post here:
viewtopic.php?t=179960

Hi @Jotne and @rplant, thanks for your feedback,
That Splunk setup really looks nice, but to be honest I would be a bit hesitant to send my logfiles over to some external server, I'd rather keep them indoors, but nevertheless I'm going to check if something similar is possible to setup here at home.
I think I currently have more or less the setup as detailed by @rplant, but I'm going to check where the delta's are since in my setup I don't have any logging info on ros, only logging in the dude.

Oh wait, I didn't read the splunk thing well enough it seems it's not a remote server that handles these nice plots, it's a local install, going to give that a try on my linux box here, and I also noticed it seems to have some support for home-assistant, that would be a great combination.

You can setup Splunk your self and have 100% control of the data. What is the different sending all logs to a sentral router??
To have secure transfer of external routers to a sentral Splunk/Router, use VPN.

Yes, I noticed my mistake already , see last few lines of my reply above.