Log Filter

RouterOS Scripting
61

Hi folks I hate to ask you but this seems to be the right place, have any of you for some weird reason updated to RouterOS V7.13?
I did it against my better judgment and now LogFilter is broken

Now I get this on Telegram

RouterOS
2024-01-03 15:35:25
Download from https://api.telegram.org/bot********/sendmessage?chat_id=-*******

my logs also have some unusual activity before it would let me know that the schedule had been updated which it still does but now i have a new line as per below with the Topics, Fetch, Info and Debug

Download from https://api.telegram.org/bot******/sendmessage?chat_id=-*****&text=RouterOS%0A2024-01-03 16:11:33%0Alogin failure for user admin from 00:00:00:00:00:00 via winbox to <nothing> FINISHED

The Logfilter works on another router I have around and it worked on here until I updated from RouterOS 7.11.2 to 7.13

62

Please post your script and error messages to analyze where the problem is.

63

The script I’m using is as per below I’ve only altered the Bot ID and ChatID.

I’m not getting an error so much as the output has been warped as per my last post I get a download link to the telegram API with my BOTID, The message I’m supposed to get is appended at the end aka “Login failure for user admin from Mac via Winbox” although the part is meant to be the router name.

This is from a working router on V7.11.2

Main-rtr
2024-01-04 11:04:40
login failure for user admin from 172.29.255.255 via api

This is from the updated router on V7.13

RouterOS
2024-01-03 16:00:03
Download from > https://api.telegram.org/bot123:abcbac/sendmessage?chat_id=-12345


:local myserver ([/system identity get name])
:local scheduleName "LogFilter"
:local bot "123:abcbac"
:local ChatID "-12345"
#Here you can specify which events from the logs you need to send.
:local startBuf [:toarray [/log find message~" failure" || message~"loop" || message~"critical" || message~"error" || message~"Excessive Average CPU load" || message~"fcs" || message~"excessive"]]

# warn if schedule does not exist
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
  /log warning "[LogFilter] Alert : Schedule does not exist. Creating schedule ...."

 /system scheduler add name=$scheduleName interval=300s start-date=Jul/09/2020 start-time=startup on-event=LogFilter

  /log warning "[LogFilter] Alert : Schedule created ."
}

# get last time
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
# for checking time of each log entry
:local currentTime
# log message
:local message
 
# final output
:local output

:local keepOutput false
# if lastTime is empty, set keepOutput to true
:if ([:len $lastTime] = 0) do={
  :set keepOutput true
}

:local counter 0
# loop through all log entries that have been found
:foreach i in=$startBuf do={
 
# loop through all removeThese array items
  :local keepLog true
  :foreach j in=$removeThese do={
#   if this log entry contains any of them, it will be ignored
    :if ([/log get $i message] ~ "$j") do={
      :set keepLog false
    }
  }
  :if ($keepLog = true) do={
   
   :set message [/log get $i message]

#   LOG DATE
#   depending on log date/time, the format may be different. 3 known formats
#   format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default
    :set currentTime [ /log get $i time ]
#   format of 00:00:00 which shows up on current day's logs
   :if ([:len $currentTime] = 8 ) do={
     :set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
    } else={
#     format of jan/01 00:00:00 which shows up on previous day's logs
     :if ([:len $currentTime] = 15 ) do={
        :set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
      }
   }
    
#   if keepOutput is true, add this log entry to output
   :if ($keepOutput = true) do={
     :set output ($output.$currentTime." ".$message."\r\n")
   }

    :if ($currentTime = $lastTime) do={
     :set keepOutput true
     :set output ""
   }
  }
  :if ($counter = ([:len $startBuf]-1)) do={
   :if ($keepOutput = false) do={    
     :if ([:len $message] > 0) do={
        :set output ($output.$currentTimer." ".$message."\r\n")
      }
    }
  }
  :set counter ($counter + 1)
}

if ([:len $output] > 0) do={
  /system scheduler set [find name="$scheduleName"] comment=$currentTime
  /tool fetch url="https://api.telegram.org/bot$bot/sendmessage\?chat_id=$ChatID&text=$myserver%0A$currentTime%0A$message" keep-result=no;
}
64

Try the last version of @rextended:
http://forum.mikrotik.com/t/log-filter/166898/1

It works fine for me with v7.13

65

I tried to apply this script to CRS with OS version 7.12, but the script sent all the last logs that appeared in CRS and did not select what was written in :local mkwd
What do you think is the cause?

66

Run the script from CLI (between {…}) and check if it dumps any errors, the script works fine for me on a RB4011 and others.

Try to check the script policies that look like this:
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon. (“ftp” is mandatory)

67

Sorry, I forgot something important in the script description, namely what you want to monitor in the log and what you don’t want. I thought this script was the same as the script created by reextended previously in the post http://forum.mikrotik.com/t/monitor-mikrotik-log-by-telegram/133039/1 but it turned out to be different. Thank you for the response