Custom --log-level in firewall rules or filtering on log file actions...

RouterOS General
1

I had a smaller set of firewall logging rules that let me know when there were behaviors that should catch my eye. Logs are forwarded to a remote syslog server and it has some rules that will fire off warning emails when certain phrases are detected in the logs. This all worked wonderfully until…

We started working with a security vendor who is providing proactive monitoring of our systems. This includes adding a “log new connection” rule into the mikrotik and sending those records to them via syslog. As you can imagine… that is a LOT of log records. My problem is now my “signal” (the handful of custom logging rules I wrote) are now lost in the noise (millions of new connection log entries).

Ideally, I’d be able to do something like this:

  1. Configure custom/“high priority” logging rules so that they would log at a level higher than “info”
  2. Configure separate logging actions for firewall !info

I think #2 is not a problem, but I don’t see a way to pass --log-level to the filter rules.

Another approach would be if there was content based filtering that could be applied in the logging rules (example: different log action if “new connection” found in the entry then if it is not).

Both of these approaches can be done in Linux, but I don’t see anything in the mikrotik documentation that indicates there is an implementation.

Any suggestions?

2

I’d use log-prefix as a differentiator, then do the actual filtering of the messages on the syslog server.

3

I’ve been getting by with that, but there are some cons:

  1. I’m sending all of the “new connections” traffic to my syslog server when I don’t need it. This means 99% of the traffic sent to it is being filtered out so I’m wasting a lot of network bandwidth + our syslogger is being pushed pretty hard keeping up. Ideally I would send non/new connection messages to my syslog server and send the new connection messages to the security vendor (instead of everything to mine which then forwards to the security vendor).

  2. I miss being able to look at the mikrotik console logs when I am troubleshooting a rule. I can’t shoe any fw messages there because of the new connection messages