Given a logging action buffer in memory, how do I clear it?
For instance this logging action buffer failedauth:
/system logging action add memory-lines=1000 memory-stop-on-full=no name=failedauth target=memory
/system logging add action=failedauth disabled=no prefix="" topics=critical,system,error
Somehow this trick does not work in RouterOS 6.37.1 to clear the logging action buffer:
{
:local logBuffer "failedauth";
:local lines;
/system logging action {
:set lines [get ($logBuffer) memory-lines];
set ($logBuffer) memory-lines 1;
set ($logBuffer) memory-lines $lines;
};
:put "$lines"
}
The trick is originally by http://www.vulninfo.com/index.php/block-ssh-brute-force-on-mikrotik-routeros/ and likely worked in the past.
–jeroen