"/log get" issue/bug ?

RouterOS Scripting
1

Hi, I’m trying to get a number of logs, latest 100 for example. And for this I’m trying to get all logs, count them and get only the desired number of lines. But i’m having some issues and I don’t get it why is this happening. Ex:

:local arr ("*1550","*1551","*1552","*1553","*1554","*1555","*1556","*1557");

for i from=7 to=0 do={:put "$[/log get number=($arr->"$i") value-name=time]"}                                                          
11:42:48
11:42:48
10:32:33
09:54:15
09:54:15
09:54:15
09:54:15
09:54:14

for i from=7 to=0 do={:put "$[/log get number=($arr->"$i") value-name=topics]"}                                                   
ovpn;info
ovpn;info
system;info;account
ovpn;info
ovpn;info
ovpn;info
ovpn;info
ovpn;info

for i from=7 to=0 do={:put "$[/log get number=($arr->"$i") value-name=message]"}      
<45.79.181.104>: disconnected <peer disconnected>
connection established from 45.79.181.104, port: 18498 to 86.124.37.163
user admin logged in from 192.168.120.183 via ssh
<167.94.138.51>: disconnected <peer disconnected>
connection established from 167.94.138.51, port: 49870 to 86.124.37.163
<167.94.138.51>: disconnected <peer disconnected>
connection established from 167.94.138.51, port: 42974 to 86.124.37.163
<167.94.138.51>: disconnected <bad packet received>

And now trying to combine all that output in 1 line:

for i from=7 to=0 do={:put "$[/log get number=($arr->"$i") value-name=time] $[/log get number=($arr->"$i") value-name=topics] $[/log get number=($arr->"$i") value-name=message]"}
11:42:48 ovpn <45.79.181.104>: disconnected <peer disconnected>;11:42:48 info <45.79.181.104>: disconnected <peer disconnected>
11:42:48 ovpn connection established from 45.79.181.104, port: 18498 to 86.124.37.163;11:42:48 info connection established from 45.79.181.104, port: 18498 to 86.124.37.163
10:32:33 system user admin logged in from 192.168.120.183 via ssh;10:32:33 info user admin logged in from 192.168.120.183 via ssh;10:32:33 account user admin logged in from 192.168.120.183 via ssh
09:54:15 ovpn <167.94.138.51>: disconnected <peer disconnected>;09:54:15 info <167.94.138.51>: disconnected <peer disconnected>
09:54:15 ovpn connection established from 167.94.138.51, port: 49870 to 86.124.37.163;09:54:15 info connection established from 167.94.138.51, port: 49870 to 86.124.37.163
09:54:15 ovpn <167.94.138.51>: disconnected <peer disconnected>;09:54:15 info <167.94.138.51>: disconnected <peer disconnected>
09:54:15 ovpn connection established from 167.94.138.51, port: 42974 to 86.124.37.163;09:54:15 info connection established from 167.94.138.51, port: 42974 to 86.124.37.163
09:54:14 ovpn <167.94.138.51>: disconnected <bad packet received>;09:54:14 info <167.94.138.51>: disconnected <bad packet received>

Now, what is happening over here :question:

First line should be in this format:

11:42:48 ovpn;info <45.79.181.104>: disconnected <peer disconnected>

Vs:

11:42:48 ovpn <45.79.181.104>: disconnected <peer disconnected>;11:42:48 info <45.79.181.104>: disconnected <peer disconnected>
2

Hi!
It works fine!
You just need to use a different operator: replace “.” with “,”.

 > { :local "x" *a8bc16 ; :put ( [ /log get number=$"x" value-name=time ],[ /log get number=$"x" value-name=topics ],[ /log get number=$"x" value-name=message ] ) ; } ;




13:27:03;firewall;info;OutputDrop: output: in:(unknown 0) out:(unknown 1), proto ICMP (type 3, code 1), 192.168.1.222->192.168.1.222, len 576
3

I’ve always hated people who write topic titles that blame bugs instead of admitting their ignorance.
If I don’t know something I admit it, instead of boasting about any bugs…

I hope you appreciate the frankness.

Here is the solution, I prefer NOT to write why so that you study for a moment to understand where YOUR mistake is.
If you don’t get there, don’t worry, if you ask me I’ll write it to you.
I hope I was helpful. Then you can also send me to hell, I’m not offended.
/log
{
# user parameters
:local arrBuffer [print as-value where buffer=memory]
:local logMax 100

# declaring empty vars
:local item [:toarray ""] ; :local Ltime "" ; :local Ltopics "" ; :local Lmessage "" ; :local lognum 0
:local lenBuffer [:len $arrBuffer]
:if ($lenBuffer > 0) do={
    :if ($logMax > $lenBuffer) do={:set logMax $lenBuffer}
    :for index from=($lenBuffer - $logMax) to=([:len $arrBuffer] - 1) do={
        :set lognum ($lognum + 1)
        :set item [:pick $arrBuffer $index]
        :set Ltime    ($item->"time")
        :set Ltopics  [:tostr ($item->"topics")]
        :set Lmessage ($item->"message")
        :put "$lognum: $Ltime $Ltopics $Lmessage"
    }
}

}
EDIT: Fixed issue if logs returned are less than logMax
EDIT: Fixed issue if logs returned were 0

4

What are you writing??? He never used “.” …
If you don’t know what to write and why it’s doing that, it’s better not to answer at all than to write at random…

5

Of course not! :slight_smile:
Just because you can't see it, doesn't mean the interpreter won't interpret it correctly.
Therefore, it must be made explicit!
Look at my example before you write. :wink:

6

Since when does it have to be answered via riddles?
However you did NOT answer him correctly, for what he asked: it’s not a bug.
Simply “topics” is an array, not a string, and when printed it reprints the full message, on same line, one for each value within the array.
So just convert “topics” to a string before treating it as a string…

And by the way your recommended “print” method sucks.
(But not because you wrote it, it’s the concept that’s ridiculous.)
Also because if you convert everything into an array (that’s just the main problem…), it will give problems later, for exactly the same reason.
For example, if you send the message on telegram, it multiplies it again…

13:27:03;firewall;info;OutputDrop: output: in:(unknown 0) out:(unknown 1), proto ICMP (type 3, code 1), 192.168.1.222->192.168.1.222, len 576
= one array of 3 elements:
0: time 13:27:03
1: sub array with two field inside: string “firewall” and string “info”
2: string “OutputDrop: output: in:(unknown 0) out:(unknown 1), proto ICMP (type 3, code 1), 192.168.1.222->192.168.1.222, len 576”

7

Try to abstract yourself a bit!
Relax. :wink:

The :put is just an illustration.
By replacing :put, you can build the data into a single line of an array.
Because I guess he doesn't want to print it either, he wants to send it to some processing routine.

8

(avoid quoting all previous post unnecessarily)

It is no coincidence that I mentioned sending the message on telegram…

Pretending I don’t exist, you’re an expert and the OP isn’t,
with your answer you neither solve his problem, nor teach him anything, nor prevent him from problems later.

9

Correct!
Excuse me!

10

Hi people, first of all really thanks for your replies and info provided here.
In the official documentation it’s not stipulated that ‘topics’ are an array type, or at least i didn’t found such information. For me it was something logic if in individual cases everything was fine and when combining them i was having strange results. Sorry for any inconvenience, for me that was the logical way, now i saw how it actually works, thank you! Lol i’m not sending you anywhere :slight_smile:
It’s not about telegram, it’s for getting logs via api calls(golang library)