Invoke script when log entry is created from failed login

RouterOS Scripting
1

It seems that there are many requests for running scripts when a certain log entry is created. Just to double-check is there any way to do this?

Worse case a script could run every minute to check the logs, but it’s mentioned elsewhere that the log contents are not available from script, is this true too?

Otherwise is it possible to run a script on failed login via winbox/telnet/ssh/hotspot?

2

or maybe, even create a new logging action that will start a script? (ultimately it would be awesome if the script environment can be populated with the logging data)

3

You can get any log message if you know its ID number

example:
:foreach i in=[/log find] do={ :put [/log get $i time] } ;

It is up to you how you will check if new log entry is added and to check its message.

4

hrmm, that’s something I can work with.

I’d still like something that would run the script as-soon as the log entry is written. (so that I don’t have to run the script every 10s).

There’s no log monitor do={} syntax is there? (or log print follow do={})

5 
:foreach i in [log print as-value follow  ] do={:put $i}

almost works, but it fails because follow doesn’t flush to foreach until you stop the follow

6

You can write a script that is checking if new log entries are added.

This script might not work correctly, it was written to show main idea.

:global lastTime;

:global currentBuf [ :toarray [ /log find buffer=pppoe  ] ] ;
:global currentLineCount [ :len $currentBuf ] ;
:global currentTime [ :totime [/log get [ :pick $currentBuf ($currentLineCount -1) ] time   ] ];

:global message "";

:if ( $lastTime = "" ) do={ 
	:set lastTime $currentTime ; 
	:set message [/log get [ :pick $currentBuf ($currentLineCount-1) ] message];

} else={
	:if ( $lastTime < $currentTime ) do={ 
		:set lastTime $currentTime ; 
		:set message [/log get [ :pick $currentBuf ($currentLineCount-1) ] message];
	}
}