I have multiple MikroTik routers, each connected to 2–3 different ISPs. I want to monitor each ISP link individually and detect when an ISP goes down or comes back up.
I initially used Netwatch, but it’s been unreliable — sometimes it shows an ISP is down even when it’s not, especially in multi-ISP routing setups.
What I want to achieve:
Accurately detect which ISP went down, at what time
Send this info to my external server (via HTTP request or API)
Store logs on the server so I can review or visualize them
Automate the whole process with minimal resource usage (no heavy monitoring tools)
Optional goals:
Show logs in a web dashboard (per router + per ISP)
Track downtime duration and generate simple reports
Maybe receive alerts (like Telegram or email) when an ISP goes down
Any advice on the most reliable approach for this? Should I use routing marks with scripts, or is there a more standard method people use?
“Netwatch” means little, in newish RoS there are so many different ways it can be configured, using different tests and fine tuning the thresholds/triggers that you cannot say that it is reliable or unreliable, it is as reliable as the (sometimes mindboggling) settings you chose.
Even on a same machine, a different ISP may need different settings to have netwatch working properly.
The alternative AFAIK can only be a scheduled script checking periodically if a link is up or down (or a route is active or not), but ultimately you would be recreating a (possibly worse) version of netwatch.
Accurately detect which ISP went down, at what time
Netwatch is still best bet. It is tricky to setup, especially if you’re using the icmp check, since there is always “default” values if left unspecified – this means a failure could be caused by just not waiting long enough in somethr-* value.
Send this info to my external server (via HTTP request or API)
From the netwatch, this needs a “two-step” operation due to permissions. Netwatch scripts use a non-root account, so they are restricted from /tool/fetch needed to call an external web services. The doc / other post describes the specifics, but essentially you need to use a /system/script with the /tool/fetch with “do not require permissions”, then have the Netwatch on-down= etc call that script. So netwatch becomes just /system/script/run "notify-server-on-failed-netwatch" that calls the script with /tool/fetch.
Store logs on the server so I can review or visualize them
Here, you want to start with the log system you want to use on your server. With that, how to wire become more obvious. RouterOS using syslog so that be better generally. You can use IPSec to your server, if you wish it encrypted. There are no “hooks” for logs, so submitting them with HTTP need a more complex script to do it well.
Automate the whole process with minimal resource usage (no heavy monitoring tools)
“Should I use routing marks with scripts”
No. Routing marks add overhead, and not really accessible to scripts in some ready-to-use manner. If Netwatch was complex…
" is there a more standard method people use?"
Show logs in a web dashboard (per router + per ISP)
Track downtime duration and generate simple reports
Maybe receive alerts (like Telegram or email) when an ISP goes down
The “Dude” is not web‡ & very old… but that what I use for monitoring RouterOS devices since it keeps history of traffic very nicely and tracks the up/down. Not saying “ideal”, but works and low-resources too. ‡ some Dude things like the “maps” do show in Webfig on web
Also RouterOS supports SNMP so whatever monitoring system you’d like should work. You can even use something ancient like mrtg on your server to pull SNMP. Or any of the modern monitoring tools. Like logging, you can setup IPSec (or WG) for payload encryption to your server if you want to encrypt the plain-text SNMP.
Finally, @Jonte has developed a nice suite of tools for Splunk around all of this – with all sorts of huersitcs to extract meaningful data from logs/etc. I do not use it, but seems closer to what you’re looking for – especially if you didn’t have some tool already. See
I know there are a few ways to handle this with netwatch but in my case, it hasn’t been all that reliable. If there’s actually a proper way to set up netwatch to track when my ISP goes down and comes back up, I’d really appreciate some help with that.
Not at all an expert but questions which come to mind:
Why hasn’t it been reliable ?
What check did you use which then failed ?
What other things (mangling, fallback, recursive routing, … ) are in place which might interfere and result in false alerts ?
You actually did not provide a lot of details regarding the context this needs to be used in.
As Jaclaz already mentioned, it’s most likely not going to be a ‘one setup for all devices’ solution.
There has been some discussion on the Netwatch (ICMP) probe and its (complex) settings (and about some quirks in the documentation) with some considerations on the parameters that can be used and their limits.
One of the posters had an issue with some (false) down sensing that were avoided by fine tuning the parameters.
I’ve totally given up on netwatch, the final straw was its inability to use FQDN’s. I’m using standalone scripts for my failover management but don’t get the more intricate thresholds you get with the advanced options in netwatch (which was why I was using netwatch in the first place).
Hi,
I use UPTIME KUMA in docker. Very simple with nice GUI. It send me message to Telegram when router(ping) is down or up. You can see uptime history. You can use for more monitoring.
I have message pop up when isp is down, but when isp is out of reach and is not up it switches to the 2nd isp but still i dont get pop about when it went down and happend way often