user admin logged in from 192.168.0.1 via web

# Script to check for specific new logs and send email alerts
# Tested on RouterOS v5.7+

# container to keep track of the last time stamp detected
:global lastTime;

# find log entries where the message contains "logged in" or "login failure"
:local currentBuf [ :toarray [ /log find message~"logged in" || message~"login failure" ] ] ;
# get number of log entries
:local currentLineCount [ :len $currentBuf ] ;

# if any logs were found, proceed
if ($currentLineCount > 0) do={
# based on number of entries, get time of last entry
	:local currentTime "$[ /log get [ :pick $currentBuf ($currentLineCount -1) ] time ]";

# check currentTime length, if length is 15, log is from a previous day and begins with month/day
	:if ([:len $currentTime] = 15 ) do={
# trim currentTime so we are left only with time xx:xx:xx
		:set currentTime [ :pick $currentTime 7 15 ];
	}
	
# the output for the body of the email, includes time stamp and log message
	:local output "$currentTime $[/log get [ :pick $currentBuf ($currentLineCount-1) ] message ]";
	
# email function
	:local sndEmail [:parse "/tool e-mail send to=email@domain.com subject=\"MikroTik alert $currentTime\" body=\"$output\" tls=yes"];

# beep function
	:local doBeep [:parse ":beep;:delay 150ms;:beep;"];


# if the last time stamp has not been set, length will be 0 (after reboot, etc)
	:if ([:len $lastTime] < 1 ) do={ 
# update lastTime to match currentTime
		:set lastTime $currentTime ; 
# send email and beep
		$sndEmail;
		$doBeep;
# if lastTime has been set, continue
	} else={
# if lastTime does not match time stamp of the latest
		:if ( $lastTime != $currentTime ) do={ 
# update lastTime to match currentTime
			:set lastTime $currentTime ; 
# send email and beep
			$sndEmail;
			$doBeep;
		} 
	}
}

:local scheduleName value="mySchedule";
:local emailAddress value="myEmail";
:local startBuf value=[:toarray [/log find where message~"logged in" or message~"login failure"] ];
:local removeThese value=[:toarray ("telnet","whatever string you want")];

:local lastTime value=("".[/system scheduler get [find name=$scheduleName] value-name=comment]);

:local currentBuf value=[:toarray ""];

:foreach i in=$startBuf do={
 :foreach j in=$removeThese do={
  :if ([/log get $i value-name=message] ~ $j) do={ } else={
   :set $currentBuf ($currentBuf,$i);
  };
 };
};

:local currentLineCount value=[:len $currentBuf];
 
if ($currentLineCount > 0) do={

 :local currentTime value=[/log get [:pick $currentBuf ($currentLineCount - 1)] value-name=time];

 :if ([:len $currentTime] = 15) do={
  :set $currentTime value=[:pick $currentTime 7 15];
 };

 :local output value=($currentTime." ".[/log get [:pick $currentBuf ($currentLineCount - 1)] value-name=message]);
    
 :if ( ([:len $lastTime] < 1) or ( ([:len $lastTime] > 0) and ($lastTime != $currentTime) ) ) do={
  /system scheduler set [find where name=$scheduleName] comment=$currentTime;
  /tool e-mail send to=$emailAddress subject=("MikroTik alert ".$currentTime) body=$output;
 }

}

:foreach j in=$removeThese do={
  :if ([/log get $i value-name=message] ~ $j) do={ } else={
   :set $currentBuf ($currentBuf,$i);
  };
 };

# BEGIN SETUP
:local scheduleName "mySchedule"
:local emailAddress "user@email.com"
:local startBuf [:toarray [/log find message~"logged in" || message~"login failure"]]
:local removeThese {"telnet";"whatever string you want"}
# END SETUP

# warn if schedule does not exist
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
  /log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name"
}

# get last time
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
# for checking time of each log entry
:local currentTime
# log message
:local message
  
# final output
:local output

:local keepOutput false
# if lastTime is empty, set keepOutput to true
:if ([:len $lastTime] = 0) do={
  :set keepOutput true
}


:local counter 0
# loop through all log entries that have been found
:foreach i in=$startBuf do={
  
# loop through all removeThese array items 
  :local keepLog true
  :foreach j in=$removeThese do={
#   if this log entry contains any of them, it will be ignored
    :if ([/log get $i message] ~ "$j") do={
      :set keepLog false
    }
  }
  :if ($keepLog = true) do={
	
	:set message [/log get $i message]

#   LOG DATE
#   depending on log date/time, the format may be different. 3 known formats
#   format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default
    :set currentTime [ /log get $i time ]
#   format of 00:00:00 which shows up on current day's logs
	:if ([:len $currentTime] = 8 ) do={
	  :set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
    } else={
#     format of jan/01 00:00:00 which shows up on previous day's logs
	  :if ([:len $currentTime] = 15 ) do={
        :set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
      }
	}
	  
#   if keepOutput is true, add this log entry to output
	:if ($keepOutput = true) do={
	  :set output ($output.$currentTime." ".$message."\r\n")
	} 
#   if currentTime = lastTime, set keepOutput so any further logs found will be added to output
#   reset output in the case we have multiple identical date/time entries in a row as the last matching logs
#   otherwise, it would stop at the first found matching log, thus all following logs would be output
    :if ($currentTime = $lastTime) do={
	  :set keepOutput true
	  :set output ""
	}
  }

#	if this is last log entry
  :if ($counter = ([:len $startBuf]-1)) do={
#   If keepOutput is still false after loop, this means lastTime has a value, but a matching currentTime was never found.
#   This can happen if 1) The router was rebooted and matching logs stored in memory were wiped, or 2) An item is added
#   to the removeThese array that then ignores the last log that determined the lastTime variable.
#   This resets the comment to nothing. The next run will be like the first time, and you will get all matching logs
	:if ($keepOutput = false) do={
#     if previous log was found, this will be our new lastTime entry		
	  :if ([:len $message] > 0) do={
        :set output ($output.$currentTime." ".$message."\r\n")
      }
    }
  }
  :set counter ($counter + 1)
}

# If we have output, save new date/time, and send email
if ([:len $output] > 0) do={
  /system scheduler set [find name="$scheduleName"] comment=$currentTime
  /tool e-mail send to="$emailAddress" subject="MikroTik alert $currentTime" body="$output"
  /log info "[LOGMON] New logs found, send email"
}

[spippan@RB2011_sp-private] /user> print 
Flags: X - disabled 
 #   NAME                                                    GROUP                                                   ADDRESS            LAST-LOGG
 0 X ;;; system default user
     admin_old                                               full                                                                       nov/26/20
 1   spippan                                                 full                                                                       mar/11/20
 2   spippan_ssh                                             full                                                                       mar/11/20
[spippan@RB2011_sp-private] /user>

:local removeTopic {"hotspot"}

:foreach j in=$removeTopic do={
# if this log topic is in the removeTopic array, it will be ignored
  :if ([/log get $i topic] ~ "$j") do={
    :set keepLog false
  }
}

/user print

# BEGIN SETUP
:local scheduleName "Send Login alert"
:local emailAddress1 "<redacted>.com"
:local emailAddress2 "<redacted>.org"
:local startBuf [:toarray [/log find message~"logged in" || message~"login failure" || message~"logged out" || message~"Long Port Knock step x"]]
:local removeThese {"zippo";"whatever string you want"}
# END SETUP

# warn if schedule does not exist
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
  /log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name"
}

# get last time
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
# for checking time of each log entry
:local currentTime
# log message
:local message
 

# final output
:local output

:local keepOutput false
# if lastTime is empty, set keepOutput to true
:if ([:len $lastTime] = 0) do={
  :set keepOutput true
}


:local counter 0
# loop through all log entries that have been found
:foreach i in=$startBuf do={
 

# loop through all removeThese array items
  :local keepLog true
  :foreach j in=$removeThese do={
#   if this log entry contains any of them, it will be ignored
    :if ([/log get $i message] ~ "$j") do={
      :set keepLog false
    }
  }
  :if ($keepLog = true) do={
   
   :set message [/log get $i message]

#   LOG DATE
#   depending on log date/time, the format may be different. 3 known formats
#   format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default
    :set currentTime [ /log get $i time ]
#   format of 00:00:00 which shows up on current day's logs
   :if ([:len $currentTime] = 8 ) do={
     :set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
    } else={
#     format of jan/01 00:00:00 which shows up on previous day's logs
     :if ([:len $currentTime] = 15 ) do={
        :set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
      }
   }
    

#   if keepOutput is true, add this log entry to output
   :if ($keepOutput = true) do={
     :set output ($output.$currentTime." ".$message."\r\n")
   }
#   if currentTime = lastTime, set keepOutput so any further logs found will be added to output
#   reset output in the case we have multiple identical date/time entries in a row as the last matching logs
#   otherwise, it would stop at the first found matching log, thus all following logs would be output
    :if ($currentTime = $lastTime) do={
     :set keepOutput true
     :set output ""
   }
  }

#   if this is last log entry
  :if ($counter = ([:len $startBuf]-1)) do={
#   If keepOutput is still false after loop, this means lastTime has a value, but a matching currentTime was never found.
#   This can happen if 1) The router was rebooted and matching logs stored in memory were wiped, or 2) An item is added
#   to the removeThese array that then ignores the last log that determined the lastTime variable.
#   This resets the comment to nothing. The next run will be like the first time, and you will get all matching logs
   :if ($keepOutput = false) do={
#     if previous log was found, this will be our new lastTime entry      
     :if ([:len $message] > 0) do={
        :set output ($output.$currentTime." ".$message."\r\n")
      }
    }
  }
  :set counter ($counter + 1)
}


# If we have output, save new date/time, and send email
if ([:len $output] > 0) do={
  /log info "[LOGMON] New login or logout logs found, sending E-Mail."
  /system scheduler set [find name="$scheduleName"] comment=$currentTime
  /tool e-mail send to="$emailAddress1" subject="MikroTik RB750Gr3 #2 Log in or out alert $currentTime" body="Sent from Microtik RB750Gr3 #2 \n \n $output"
  /tool e-mail send to="$emailAddress2" subject="MikroTik RB750Gr3 #2 Log in or out alert $currentTime" body="Sent from Microtik RB750Gr3 #2 \n \n $output"
  /log info "Login / Logout update E-Mail sent."
}

add action=drop chain=input comment="Long Port Knock step 1 log blocker" \
    dst-address=8.7.4.3 dst-port=54321 in-interface=VLAN_200 \
    protocol=tcp src-address-list="Long Knock-1"
add action=add-src-to-address-list address-list="Long Knock-1" \
    address-list-timeout=15s chain=input comment=\
    "Long Port Knock setup step 1" dst-address=8.7.4.3 dst-port=54321 \
    in-interface=VLAN_200 log=yes log-prefix="Long Port Knock step 1" \
    protocol=tcp
    
add action=drop chain=input comment="Long Port Knock step 2 log blocker" \
    dst-address=8.7.4.2 dst-port=45123 in-interface=VLAN_200 protocol=\
    tcp src-address-list="Long Knock-2"
add action=add-src-to-address-list address-list="Long Knock-2" \
    address-list-timeout=15s chain=input comment=\
    "Long Port Knock setup step 2" dst-address=8.7.4.2 dst-port=45123 \
    in-interface=VLAN_200 log=yes log-prefix="Long Port Knock step 2" \
    protocol=tcp src-address-list="Long Knock-1"
    
add action=drop chain=input comment="Long Port Knock step 3 log blocker" \
    dst-address=8.7.4.1 dst-port=32145 in-interface=VLAN_200 \
    protocol=tcp src-address-list="Long Knock-3"
add action=add-src-to-address-list address-list="Long Knock-3" \
    address-list-timeout=15s chain=input comment=\
    "Long Port Knock setup step 3" dst-address=8.7.4.1 dst-port=32145 \
    in-interface=VLAN_200 log=yes log-prefix="Long Port Knock step 3" \
    protocol=tcp src-address-list="Long Knock-2"
    
add action=drop chain=input comment="Long Port Knock step 4 log blocker" \
    dst-address=8.7.4.5 dst-port=14725 in-interface=VLAN_200 protocol=\
    tcp src-address-list=Safe
add action=add-src-to-address-list address-list=Safe address-list-timeout=1m \
    chain=input comment="Long Port Knock setup step 4" dst-address=\
    8.7.4.5 dst-port=14725 in-interface=VLAN_200 log=yes log-prefix=\
    "Long Port Knock step 4" protocol=tcp src-address-list="Long Knock-3"

 If we have output, save new date/time, and send email
if ([:len $output] > 0) do={
/file print file=accesslog
/file set [find name="accesslog"] contents="$output"
  /system scheduler set [find name="$scheduleName"] comment=$currentTime  
  /tool e-mail send to="$emailAddress" subject="$output"" file="accesslog";
  /log info "[LOGMON] New logs found, send email";
  /file remove accesslog.txt;
}

# jul/16/2017 20:23:32 by RouterOS 6.39.2
# software id = 9Z71-UNW2
#
 # NAME                   TYPE                        SIZE CREATION-TIME       
 0 flash                  disk                             dec/31/1969 20:00:01
 1 disk1                  disk                             dec/31/1969 20:00:02
 2 flash/skins            directory                        dec/31/1969 20:00:02

/file set [find name="accesslog"] contents="test123"

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 6.43.2 (c) 1999-2018       http://www.mikrotik.com/

[?]             Gives the list of available commands
command [?]     Gives help on the command and list of arguments

[Tab]           Completes the command/word. If the input is ambiguous,
                a second [Tab] gives possible options

/               Move up to base level
..              Move up one level
/command        Use command at the base level

# BEGIN SETUP
:local TelegramBotToken "110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw"
:local TelegramChatId   "-1501445581143"
:local RemoveThese {"telnet";"whatever string you want"}
# END SETUP
# final output
:local output
:local EventMessage
:local EventTime
:local KeepOutput false
:local KeepInLog true
#Get id of all log entry
:local StartBuf [:toarray [/log find]]
:global LastId
if ([:len $LastId] < 1) do={
  :set output ("Last log id not found. Maybe Router was rebooted%0A")
  if ([:len $StartBuf] > 0) do={:set LastId [:pick $StartBuf ([:len $StartBuf]-1)]}
}  
:foreach i in=$StartBuf do={
  if ($KeepOutput = true) do={
    :set EventMessage [/log get $i message]
    :set EventTime [/log get $i time]
# loop through all RemoveThese array items. if this log entry contains any of them, it will be ignored
    :set KeepInLog true
    :foreach j in=$RemoveThese do={:if ($EventMessage ~ "$j") do={:set KeepInLog false}}
    if ($KeepInLog = true) do={:set output ($output.$EventTime." ".$EventMessage."%0A")}
  } else={
    if ($i = $LastId) do={:set KeepOutput true}
  }
}
:set LastId [:pick $StartBuf ([:len $StartBuf]-1)]
# If we have output send message
if ([:len $output] > 0) do={
  :set output ([/system clock get date]." log from ".[/system identity get name]."%0A".$output)
  /tool fetch url="https://api.telegram.org/bot$TelegramBotToken/sendmessage\?chat_id=$TelegramChatId&text=$output" keep-result=no
}

script error: no such item (4)

:local date ([:pick [/system clock get date] 7 11] ."-". [:pick [/system clock get date] 0 3]);
/log print append follow-only file="MicroSD/export-security-log-$date" where topics~"firewall" message ~"export: security"