In my project to monitor MT devices I did use SSH to collect information from the MT.
To get information I did use.
- Syslog
- SNMP
- SSH
But this is complicated if you have more than one device.
So I did change everything around.
Now a script on the MT do send all information I need using Syslog to a dedicated Syslog server.
Se more information here:
http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/1
This could easily be adopted to monitor PPP session.
Anyway, this may be wrong
send "ppp active print where caller-id=XX:XX:XX:XX:XX:XX";
I think is should be
send "/ppp active print where caller-id=XX:XX:XX:XX:XX:XX";
PS when a user logs inn to a L2TP or PPTP session MT sends out lots of logging about that to syslog.
So if that is what you like to see, no need to grab ppp active print
It looks like this in syslog:
l2tp,ppp,info,account MikroTik: userxxx-mobil logged in, 10.2.0.3
l2tp,info MikroTik: first L2TP UDP packet received from 77.xx.xx.170