large logging

RouterOS Beginner Basics
1

when I check my log in Winbox, I found that there is serveral logs lines from firewall info every second
ex:

13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:3d:6a:a1, p
roto TCP (ACK,PSH), 192.168.2.10:64619->213.199.177.157:443, len 767 
13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:0a:00:73, p
roto TCP (ACK), 192.168.2.6:2707->207.46.113.78:443, len 32 
13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:15:0b:f1, p
roto TCP (ACK,FIN,PSH), 192.168.2.60:51772->64.4.34.159:443, len 90 
13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:15:0b:f1, p
roto TCP (ACK,PSH), 192.168.2.60:60471->64.4.61.111:1863, len 186 
13:33:39 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK), 213.199.177.157:443->192.168.2.10:64619, len 20 
13:33:39 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK,FIN,PSH), 213.199.177.157:443->192.168.2.10:64619, len 856 
13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:0a:00:73, p
roto TCP (ACK), 192.168.2.6:2707->207.46.113.78:443, len 32 
13:33:39 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK,PSH), 64.4.61.111:1863->192.168.2.124:64807, len 209 
13:33:39 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK), 64.4.61.111:1863->192.168.2.60:60471, len 20 
13:33:39 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:0e:a0:00, p
roto TCP (ACK), 192.168.2.124:64807->64.4.61.111:1863, len 20 
13:33:39 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK), 207.46.113.78:443->192.168.2.6:2707, len 1472 
13:33:40 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:15:0b:f1, p
roto TCP (ACK,RST), 192.168.2.60:1137->207.46.21.124:443, len 20 
13:33:40 firewall,info forward: in:outside1 out:hotspot, src-mac xx:xx:xx:5a:5b:18, p
roto TCP (ACK,RST), 207.46.21.124:443->192.168.2.60:1137, len 20 
13:33:40 firewall,info forward: in:hotspot out:outside1, src-mac xx:xx:xx:0a:00:73, p
roto TCP (ACK), 192.168.2.6:2707->207.46.113.78:443, len 20

Is this normal?if not what should I do?

2

You have set firewall rule with action “log” that is why you see these entries.

3

Is there problem with this amount of logs?

should I remove the log?From where in Winbox?

4

I think the log is set to show 100 lines.

Should I disable this large amount of logs?

From where I can disable this firewall info log?

5



You have set firewall rule with action “log” that is why you see these entries.

Remove the firewall rule that has the action LOG !

6

Is it good idea to remove them? I add those firewall rules for protection from Netcut and others

edit:
I found one rule has action log and has comment “log and reject the rest”
edit:
I see under that comment theier is another rule with action drop. so the log rule only show the log and will not effect anything. Is that right?

7

I disable that log rule. Now how can I clear those lines from log window in Winbox so I can see only new enteries

8

New entries get added at the bottom. There is no need to flush the logs.

How would logging actively protect you anything if you’re asking basic questions about it?

You should read A+ and Network+ books. You are asking VERY basic questions that are usually solved by reading the manual.

9

since it is firewall rule so I though it might do something and keep log but it seems that keep log only

10

it is just for informative use, so that you can see what packets are actually matched.

11

Always read the manual before adding configuration you do not understand.

log - add a message to the system log containing following data: in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as passthrough

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Properties