Very good the script appears to function correctly! (cannot test fully until the script is finished and applied to all CPE’s!)
Next step if I could suggest is to write to a new file which contents could be cleared (or deleted) once the email alert is sent,as default logs cannot be deleted (log line size reduced maybe)
http://forum.mikrotik.com/t/how-to-clear-log/24416/23
Here is a script I use to detect routing errors from the logs and send a email, not sure if this can be of help ( it also needs to read from separate file and not the default logs?)
:global lastTime;
:local adminmail1 "XXXXXXXXX@gmail.com";
:local adminmail2 "XXXXXXXX@hotmail.com";
:local sub1 ([/system identity get name])
:local sub2 ([/system clock get time])
:local sub3 ([/system clock get date])
:local company ""
:local gmailid xxxxxxx@gmail.com
:local gmailuser xxxxxxxx@gmail.com
:local gmailpwd
:local gmailport 587
:local gmailsmtp
:set gmailsmtp [:resolve "smtp.gmail.com"]
:local currentBuf [ :toarray [ /log find message~"new master flag=false" || message~"wrong peer state" || message~"init" || message~"2-WAY" || message~"Full to Down"] ] ;
:local currentLineCount [ :len $currentBuf ] ;
if ($currentLineCount > 0) do={
:local currentTime "$[ /log get [ :pick $currentBuf ($currentLineCount -1) ] time ]";
:if ([:len $currentTime] = 15 ) do={
:set currentTime [ :pick $currentTime 7 15 ];
}
:local output "$currentTime $[/log get [ :pick $currentBuf ($currentLineCount-1) ] message ]";
:if (([:len $lastTime] < 1) || (([:len $lastTime] > 0) && ($lastTime != $currentTime))) do={
:set lastTime $currentTime ;
/tool e-mail set address=$gmailsmtp port=$gmailport start-tls=yes from=$gmailid user=$gmailuser password=$gmailpwd
/tool e-mail send to=$adminmail1 subject="$sub3 $sub2 Router:$sub1 Routing Error " body="$output" start-tls=yes
/tool e-mail send to=$adminmail2 subject="$sub3 $sub2 Router:$sub1 Routing Error " body="$output" start-tls=yes
}
}