executed a script on log event

[Jotne]

See my posts in this thread:
http://forum.mikrotik.com/t/black-list-for-failed-login-to-ipsec-vpn/130090/1

It uses the log to block VPN users that do not have correct credentials.