In logs is a lot of entry.
it’s not an argument. use a remote syslog tool and filter out exactly what you need. export is not for security management, it’s for configuration export.
How I can see that configuration was changed ?
If I add new user I can’t see any changes in export - this is ok for security.
But backup is changed in time and I can’t orientate on backup size or content.
Difference between backup and export-how to monitor changes
I want to make a backup only if config was changed.
The status (enabled/disabled) of the default entry in the telnet mac-server configuration is always missing from the compact export output. To illustrate:
[admin@WhiteIron] > /tool mac-server
[admin@WhiteIron] /tool mac-server> print
Flags: X - disabled, * - default
# INTERFACE
0 * all
[admin@WhiteIron] /tool mac-server> export
# jan/02/1970 02:47:49 by RouterOS 5.12
#
/tool mac-server
set [ find default=yes ] disabled=no interface=all
/tool mac-server mac-winbox
set [ find default=yes ] disabled=no interface=all
/tool mac-server ping
set enabled=yes
[admin@WhiteIron] /tool mac-server> export compact
# jan/02/1970 02:47:52 by RouterOS 5.12
#
[admin@WhiteIron] /tool mac-server> set 0 disabled=yes
[admin@WhiteIron] /tool mac-server> export
# jan/02/1970 02:48:05 by RouterOS 5.12
#
/tool mac-server
set [ find default=yes ] disabled=yes interface=all
/tool mac-server mac-winbox
set [ find default=yes ] disabled=no interface=all
/tool mac-server ping
set enabled=yes
[admin@WhiteIron] /tool mac-server> export compact
# jan/02/1970 02:48:09 by RouterOS 5.12
#
[admin@WhiteIron] /tool mac-server>
Export of the WinBox mac-server configuration works as expected.
Compact export of firewall address lists produces funky results. This:
/ip firewall address-list
add address=0.0.0.0/8 comment=bogons disabled=no list=blacklist
add address=10.0.0.0/8 comment=bogons disabled=no list=blacklist
add address=127.0.0.0/8 comment=bogons disabled=no list=blacklist
add address=169.254.0.0/16 comment=bogons disabled=no list=blacklist
add address=172.16.0.0/12 comment=bogons disabled=no list=blacklist
add address=192.0.0.0/24 comment=bogons disabled=no list=blacklist
add address=192.0.2.0/24 comment=bogons disabled=no list=blacklist
add address=198.18.0.0/15 comment=bogons disabled=no list=blacklist
add address=198.51.100.0/24 comment=bogons disabled=no list=blacklist
add address=203.0.113.0/24 comment=bogons disabled=no list=blacklist
add address=224.0.0.0/3 comment=bogons disabled=no list=blacklist
Turns into this, which is not quite the same:
/ip firewall address-list
add comment=bogons list=blacklist
add address=10.0.0.0/8 comment=bogons list=blacklist
add address=127.0.0.0/8 comment=bogons list=blacklist
add address=169.254.0.0/16 comment=bogons list=blacklist
add address=172.16.0.0/12 comment=bogons list=blacklist
add address=192.0.0.0/24 comment=bogons list=blacklist
add address=192.0.2.0/24 comment=bogons list=blacklist
add address=198.18.0.0/15 comment=bogons list=blacklist
add address=198.51.100.0/24 comment=bogons list=blacklist
add address=203.0.113.0/24 comment=bogons list=blacklist
add address=224.0.0.0/3 comment=bogons list=blacklist
what’s the difference? import them both and get same result
thanks
i think he was mentioning this: address=0.0.0.0/8, the /8 is not accounted for.
Will be nice to have somthing like
/export compact file=some_backup_file
and to see as result the difference between some_backup_file configuration and current one.
I mean it’s better to have way to compare between few configurations.
currently file= will save export to file (as you might know), will consider export comparison., but no promises.
there is a utility for RSC file comparison. you can search the forum
thanks, that’s what I meant!
Thanks for the awesome program!
export compact vs export
just one line so you can see the difference.
compact -
add chain=forward comment=“ICMP 11:0 and limit for 5pac/s” disabled=yes icmp-options=11 limit=5 protocol=icmp
normal export-
add action=accept chain=forward comment=“ICMP 11:0 and limit for 5pac/s” disabled=yes icmp-options=11:0-255 limit=5,5 protocol=icmp
appears to have problems with commas and colons.
Other than that, I’m happy to see the compact export option.
ssid missing from compact export.
Thanks for the file compare script. Haven’t tried it yet but should prove very useful.
Compact:
/routing ospf area range
add area=backbone
Regular:
/routing ospf area range
add advertise=yes area=backbone cost=calculated disabled=no range=0.0.0.0/0
Should be:
/routing ospf area range
add area=backbone range=0.0.0.0/0
With the export changes in 5.12 a lot of the exported items in both compact and normal mode were converted to a form that works better with existing settings (e.g. using “set [ find default=yes ]” rather than “add”), however, there are still a lot that use add in ways that might conflict with a default configuration or at least created duplicate entries (e.g. “/system logging”, possibly “/ip firewall filter”). For things like this it might make sense to preceed the list of adds with a “remove [ find ]”.
This is not a problem, it’s a feature. Since v5.12 a lot of new “default” settings have been added, and what you described as a problem, will actually work in all routers, even with no config.
So the claim is no more editing the exported configuration to be able to restore using it? That would be pretty cool.
yes, that is final goal.