/system logging action add name="loginTrackerLocal" target=memory memory-lines=5000 memory-stop-on-full=no
/system logging add topics=system,info,account action=loginTrackerLocal

# buffer the loginTrackerLocal logging queue into an array
# array is 0 based and contains pointers to actual log records
:local logBuffer [/log find buffer=loginTrackerLocal];
# immediately mark that the script was run by inserting a log record
# otherwise lines might get inserted during script run, which we'd miss during the next run
:log info "ran loginTracker script"
# record buffer length for easier reference
:local logBufferLen ([:len $logBuffer] - 1);
# move backwards through the array to find the last line indicating this script ran
# linePointer will point to the first log record pointer that is interesting
:local linePointer $logBufferLen;
# set a variable that allows early escaping
:local found false;
:while (($found = false) and ($linePointer > 0)) do={
# fetch a log record
    :local logRecord [/log get [:pick $logBuffer $linePointer] message];
# check if it contains the magic string "ran loginTracker script", which this script logs when it starts up
    :if ([:find $logRecord "ran loginTracker script"] >= 0) do={
# we found the last time it ran, escape from loop
        :set found true;
    } else={
# not there yet, move on to the previous log record
        :set linePointer ($linePointer - 1);
    }
}
# prepare the e-mail body
:local body ""
# move forward through array from linePointer to end, examining all records since last script run
:for counter from=$linePointer to=$logBufferLen do={
# fetch a log record
    :local logRecord [/log get [:pick $logBuffer $counter] message];
# check if it contains the magic string "logged in from"
    :if ([:find $logRecord "logged in from"] >= 0) do={
# append to body
		:set body ($body . "\n" . $logRecord);
    }
}
# check if any lines were found
:if ([:len $body] > 0) do={
	/tool e-mail send subject="whatever" from="whatever" to="recipient@example.com" body=$body
}

/system scheduler add name=loginTracker start-date=jan/01/2009 start-time=00:00:00 interval=5m