RouterOS is capable of logging various system events and status information. g server (RFC 3164).

Log messages

Sub-menu level: `/log`

All messages stored in the device local memory can be printed from the menu /log. Each entry contains time and date when the event occurred,at this message belongs to and the message itself.

[admin@uselogg Noted in from 10.1.101.212 via winbox 
sep/15 12:33:18 system,info item added by admin 
sep/15 12:34:26 system,info mangle rule added by admin 
sep/15 12:34:29 system,info mangle rule moved by admin 
sep/15 12:35:34 system,info mangle rule changed by admin 
sep/15 12:42:14 system,info,account user admin logged in from 10.1.101.212 via telnet 
sep/15 12:42:55 system,info,account user admin logged out from 10.1.101.212 via telnet 
01:01:58 firewall,info input: in:ether1 out:(none), src-mac 00:21:29:6d:82:07, proto UDP, 
                          10.1.101.1:520->10.1.101.255:520, len 452

If logs are printed on the same date when the log entry was added, then only time will be shown. In the example above you can see that the second message was added on sep/15 current year (a year is not added) and the last message was added today so only the time is displayed.

Note:

The print command accepts several parameters that allow detecting new log entries, print only necessary messages and so on. For more information about parameters refer to the scripting manual !!!!!!!!! link here

For example, the following command will print all log messages where one of the topics is info and will detect new log entries until Ctrl+C is pressed:

[admin@user] /log > print follow where topics~".info"
12:52:24 script,info hello from script
-- Ctrl-C to quit.

If the print is in follow mode you can hit 'space' on the keyboard to insert separator:

[admin@user] /log > print follow where topics~".info"
12:52:24 script,info hello from script

 = = =   = = =   = = =      = = =   = = =   = = =      = = =   = = =   = = =

-- Ctrl-C to quit.

Logging configuration

Sub-menu level: `/system logging`

Property	Description
action (name; Default: memory)	Specifies one of the system default actions or user specified action listed in the actions menu.
prefix (string; Default: )	The prefix added at the beginning of log messages.
topics (account, bfd, caps, ddns, dns, error, gsm, info, iscsi, l2tp, manager, ntp, packet, pppoe, radvd, rip, script, smb, sstp, system, timer, vrrp, web-proxy, async, bgp, certificate, debug, dude, event, hotspot, interface, isdn, ldp, mme, ospf, pim, pptp, raw, route, sertcp, snmp, state, telephony, upnp, warning, wireless, backup, calc, critical, dhcp, e-mail, firewall, igmp-proxy, ipsec, kvm, lte, mpls, ovpn, ppp, radius, read, rsvp, simulator, ssh, store, tftp, ups, watchdog, write; Default: info)	Log all messages that fall into a specified topic or list of topics. '!' character can be used before the topic to exclude messages falling under this topic. For example, we want to log NTP debug info without too many details: `/system logging add topics=ntp,debug,!packet`

/log

System logs

debug

Parameter	Type	Description	Additional Notes
message	Type: string	Message that should be printed into log

error

Parameter	Type	Description	Additional Notes
message	Type: string	Message that should be printed into log

find

Find items by value

Parameter	Type	Description	Additional Notes
where	Type: query_arg query: True	Generates output depending on values supplied (used mainly for scripting)

get

Gets value of item's property

Parameter	Type	Description	Additional Notes
number	arg_node	Item number
value-name	enum [buffer \| message \| time \| topics]	Name of the value you want to get

info

Parameter	Type	Description	Additional Notes
message	Type: string	Message that should be printed into log

print

Show local logging information

Parameter	Type	Description
append	Type: switch value: True	Controls if print to file overwrites or appends to content of an existing file
as-value	Type: switch interesting: False value: True	Prints out output as value (used in scripting)
brief	Type: switch value: True	Displays brief description
count-only	Type: switch value: True	Shows only the count of special login users
default-config	Type: switch sysc: 3 value: True
detail	Type: switch value: True	Displays detailed information
file	Type: string	Print the content of the submenu into specific file
follow	Type: switch value: True	Updates output in real-time
follow-only	Type: switch value: True	Will output changes that have occured after invoking command
follow-strict	Type: switch value: True
interval	time [200000000 .. 9223372036854775807] unit: 1000000	Displays information and refreshes it in selected time interval
proplist	Type: obj_arg +arg: {'producer': 'enum_arg', 'sub': [{'key': '#mapping', 'value': {'producer': '', 'sub': [{'key': '', 'value': {'producer': 'const_mapping', 'sub': [{'key': 'data', 'value': {'producer': '', 'sub': [{'key': 'buffer', 'value': 0}, {'key': 'message', 'value': 3}, {'key': 'time', 'value': 1}, {'key': 'topics', 'value': 2}]}}, {'key': 'help', 'value': {'producer': '', 'sub': [{'key': 3, 'value': 'Message that should be printed into log'}]}}]}}]}}, {'key': 'acc', 'value': {'producer': '"ufd0007"', 'sub': []}}, {'key': 'hint', 'value': 'Name of the value you want to get'}, {'key': 'setUnsetAcc', 'value': {'producer': '"bfd0008"', 'sub': []}}]}	Names of properties
show-ids	Type: switch value: True	Prints static IDs for selected submenu (Requires: Option.npk)
terse	Type: switch value: True	Show details in compact and machine friendly format
value-list	Type: switch interestings can be saved in routers memory (RAM), disk, file, sent by email or even sent to a remote syslo: False value: True	Show properties one per line
where	Type: query_ar query: True	Generates output depend on values supplied (used mainly for scripting)
without-paging	Type: switcsh value: thTrue	Displys infor] /log> prinmat jan/02/1970 02:00:09 system,info router rebooted sep/15 09:54:33 system,info,aon in one pieccount user admin e

warning

Parameter	Type	Description	Additionas
message	Type: string	Message that should be printed into log

Page tree

Log