bug in ROS or in my head?

good day, i need help:
i have a script at PPP profile (On Down):

:local aaa;
:set aaa [/log print as-value where time>([/system clock get time]-5s) && topics~"ovpn" && topics~"info" && message~"logged out"];
:set aaa [:pick [:tostr $aaa] [:find [:tostr $aaa] "from" -1] ([:find [:tostr $aaa] "from" -1]+33)];

when ovpn user disconect, i try to catch string from log, and it’s work fine… but after mindight, e.g at 00:10:15 this code return empty value, and e.g at 08:10:15 and to mindight it’s work properly
what’s wrong? :wink:
p.s. ROS v6.47.9 (long term)

This may be due to that time format in logs are not equal over new day change.

IF Mikrotik has used RFC-3164 in their log format, this would have been fixed. Look at these two log messages.

apr/05 12:59:00 > system,info,account user xyz logged out from 10.12.12.178 via ssh
11:01:32 > system,info,account user xyz logged in from 10.12.12.32 via telnet

http://forum.mikrotik.com/t/feature-request-rfc3164-log-conformity/11518/1
http://forum.mikrotik.com/t/how-to-get-log-records-for-last-5-mins/70398/7

First time requested Februar 2007!!! 14 years ago, so you may have to wait some more years before they add it :slight_smile:

phew, so bug isn’t in my head :slight_smile:
thx!