We're running multiple Mikrotik switches in the network and I cannot find a way to log stp changes. I need to log them because I'm trying to troubleshoot a strange issue with one of our switches that I suspect is related to (R)STP. Problem is that the issue might not occur at all for weeks at a time or it might not occur while I'm physically next to the switch so I cannot log into using a serial cable and check things out (logging in remotely is not an option as the switch is inaccessible while the problem is ongoing). I want to check for STP related events, but I cannot find a way to do it.
WHAT I HAVE TRIED
I have tried using the bridge filter function using the rstp multicast dst mac address 01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF but it does not capture anything. I have tried setting different stp flags like tcn, or tried to match timers (e.g., Hello time 2s) to get a hit. I ended up just making the following rules to log all traffic going through the interface
Code: Select all
/interface bridge filter
add action=log chain=input disabled=no in-interface=ether2 log=yes log-prefix=\
testinpu
add action=log chain=output disabled=no log=yes log-prefix=testoutp \
out-interface=ether2
add action=log chain=forward disabled=no in-interface=ether2 log=yes \
log-prefix=testfor out-interface=ether2
I have come across some other similar forum posts but none has apparently reached any conclusion regarding this matter (e.g., viewtopic.php?t=73621). Appreciate your time!