Page 1 of 1

Log mangle to remote syslog only

Posted: Thu Sep 19, 2013 8:10 am
by fabricioviana
Hello! Please, need some help:

I have this rule in mangle:

/ip firewall mangle
add action=log chain=prerouting connection-state=new disabled=no log-prefix=ACCESS-LOG

And in Logging:

/system logging
set 0 action=memory disabled=no prefix="" topics=info
set 1 action=memory disabled=no prefix="" topics=error
set 2 action=memory disabled=no prefix="" topics=warning
set 3 action=echo disabled=no prefix="" topics=critical
add action=remote disabled=no prefix=ACCESS-LOG topics=info

remote action in /system logging action is configured with my remote syslog machine.

All "ACCESS-LOG" log are going to remote syslog machine normally!

My problem is: in addition to being sent to the remote server, "ACCESS-LOG" also appears in winbox LOG menu as "firewall info". Because there is many lines with "ACCESS-LOG" I cannot see other important information (ppp, API, SSH and other logs).

So, how do I get "ACCESS-LOG" packages only into the remote server and NOT into winbox log as "firewall info"?

Thanks!!

Fabricio

Re: Log mangle to remote syslog only

Posted: Thu Sep 19, 2013 2:45 pm
by helltallica
Hmmm if you change the action of the mangle rule to accept, your logs won't go to memory ("winbox log"), but will they go to remote server?