Hello,
I try to find how can Log/Audit admin command and send to log server but I don’t see something else.
I found just /system/history but the information is not enough.
Does somebody know how can log everything user/admin command on router ?
Best Regards,
There is no command logging implemented.
So, I noticed that RouterOS notifies when a user logs in and out. Possibly this could be leveraged similarly to how the SolarWinds NCM Real Time Change Notification feature works. It looks for the syslog entry indicating that user left configuration mode and then downloads a configuration file. It then diffs the download with the last known version and sends an EMAIL with the contents of the diff.
It’s certainly better than nothing, that said a PPPoE server may mess with that solution but you’d have to test it. RANCID may have something that behaves similar or at least give you a base to start from. Either way unless MikroTik does it for you the best you can do is mimic SolarWinds NCM RTCN.