Formatted Syslog Output

RouterOS General
1

Hi,
This may well be the stupidest question ever posted here… and if it is, my apologies.

Is it possible to define a log format?

I’ve written my own Syslog collector ages ago (small .NET application that runs as a windows service on one of our servers. It puts the log entries into an SQL Database. Was setup for our previous firewall, not a MikroTik. Worked extremely well, but the log format was a bit easier to write a parser for, as there were consistent delimiters with a basic format of [fieldName]=[value]).

Is it possible to do something like this with the MikroTik log somehow?
I think I’m right in saying that however the log is formatted, this will be sent as the MSG part of the Syslog transmission, so I guess it’s the MikroTik log part that I need to look at, right?
Getting something like:

[FieldName]=[Value];[FieldName]=[Value]...

would be absolutely ideal… not sure if I’m asking too much here though.

Thanks very much in advance.

Colin

2

Syslog is a standard, and as such all messages no matter the vender should be in the same generalized format. See RFC 5424

3

there is also BSD syslog standard RFC3164 <–which mikrotik definitely supports (needs to be enabled)

4

related: http://forum.mikrotik.com/t/logging-prefix-is-a-mess-sup-105353-sup-144261-waiting-for-mt-to-support-rfc-5424/111067/17

5

I ended up re-writing my syslog listener such that it uses RegEx to pull out the various. It’s of the syslog messages that I, interested in… then it was super easy to get the format I wanted and I now have everything being logged to an SQL Database.