I would like to make my Mikrotik beep every time a certain log item is added
My thinking of doing this is as follows:
Add Log Action of Beep
Add Log Rule for Topic Firewall to have action Beep
This way every time the router adds a firewall log entry it will also beep.
I can’t do step 1 in the above and can’t find any answers of how to do that, is it possible for me to do this myself or would something like this only work if Mikrotik implement in routerOS?
High level:
add the log action firewall with a specific prefix
Then use a script to search for new entries in log file where that prefix is present, in case it found a new entry, beep.
There should be plenty of examples present here where all the required bits and pieces are available.
Obviously this will only work if your device is equipped with a beeper (it’s getting rare …).
Personal comment: why would you want to do that ? I’m pretty sure you’ll disable that quite fast ! I know I would.
Personal comment2: why not send a mail instead of beep ? Less intrusive for other people also being present in the same room as that router AND works for you then wherever you are.
Also there, plenty of examples available for the required bits and pieces.
Like here, for a good starting point: http://forum.mikrotik.com/t/monitor-logs-send-mail-alert-wiki-script/149348/1
/log
:foreach item in=[find where (([$id2num $“.id”] > $lastLog) and (buffer=memory) and (message~“beep”))] do={
:set lastLog [$id2num $item]
:beep frequency=4000 length=500ms
}
}
Just set it in the scheduler to run every 10 seconds.
In the example, if the device has it, it emits a beep every time one entry, containing “beep” on message, is logged
I am alone in the room so it beeping won’t affect others. I won’t use it for all rules, only specific ones where I need to be made immediately aware that a certain rule has been breached
I have the hEX, it definitely has beep functionality - in a terminal when I type “beep” it beeps
Just to update, the solution is working perfectly BUT it is quite CPU intensive
In an extreme scenario where I’m checking the logs every 1 second, the CPU usage sits at a constant 20%
For a bit of background, I have setup DNS-over-HTTPs on my computer (not on the Mikrotik, I have my reasons) but this service tends to get switched off from time-to-time for unknown reasons. I added firewall rules to block all unencrypted DNS (which would route over port 53 on the UDP protocol), when this happens it gets written to the log. I have implemented the solution of this thread so that as soon as the log gets an item indicating that the DoH service has stopped and unencrypted DNS requests are trying to leave the network it starts beeping to notify me and I then go and restart the DoH service.
This way I never have unencrypted DNS leaving my network. It’s all either encrypted and allowed through the router or blocked by the router (in which case I can’t DNS until I fix it)
Make feature request for ROS to add for log action script trigger event like scheduler or netwatch have (eg. on-event). Then it will possible immediately perform some rsc code (beep, led…) for log record with specified action without need iterating log records in scheduler.
Also will be good to have additional optional config property for such log action event trigger to have time period in which event will be not triggered within defined time, to save CPU or in your case beeper not repeats multiple times in a row if log records with such action are logged in short time interval.
A more better way I think will be to put an option in a firewall action tab to run a script, just below the log field. That way we could customize event action and assign a different beep patterns to a different firewall filters. I think that’s what OP wants.
Yes it is, checking the log seems to be very inefficient.
I have a script that checks the log for activity (thank you rextended), when it is done it reruns the script.. Ties up an entire CPU core, when it is done, it simply repeats instead of being scheduled to start again, not uncommon for it to take 5 minutes to restart, after I cut the log down to 250 lines.
Perhaps for the OP’s case but there are other uses for checking the log, not related to the firewall.
