To see when each firewall rule are used, you can have a look at my logging prosjekt over here:
http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-4-0-graphing-everything/153043/1
Each rule to log are named and set to log.
Here are some that tries to access non open port on utside (If they do, they are block to the router for 24 hours to all ports)
