Log rule regex doesn't work for negative lookahead

RouterOS General
1

I have just upgraded all my MikroTik routers/switches to RouterOS v7.17.2.

My case is that I have some log rules that are sending all ‘critical’ and ‘error’ logs by email and I want to exclude some logs with specific messages - for example I want to exclude all the following NTP time update logs that I am getting multiple times per day:

system,clock,critical,info: ntp change time Feb/26/2025 08:52:45 => Feb/26/2025 08:52:44

To exclude these logs I want to use the newly introduced regex parameter in my log rules that will exclude all ntp change time entries.

The regex is the following, it is using a negative lookahead and it should match all messages that have no “ntp change time” text (so basically all log entries except the “ntp change time” ones):

^((?!ntp change time).)*$

Config:

/system logging
add action=email regex="^((\?!ntp change time).)*\$" topics=error
add action=email regex="^((\?!ntp change time).)*\$" topics=critical

Unfortunately when I set this regex in my log rule no other messages are matched by these log rules, it seems that setting the regex above excludes all log messages.

Please help me figure out what I am doing wrong or is it just a bug?

2

Simply RouterOS for RegEx use only POSIX standard without metadata (Character classes) or syntax from other languages

https://en.wikibooks.org/wiki/Regular_Expressions/POSIX_Basic_Regular_Expressions

3

Thanks. So if I am correct it is currently impossible to exclude log entries containing specific messages using a regex pattern? I would have to exclude whole topics?

4 
/log print where (!(message~"ntp change time"))
5

This would work when I would like to manually filter the logs but I want to use my log rules (/system logging) for this that automatically send me these log entries to my email.

6

I know, but negative lookahead frop PHP is unsupported on all POSIX revision (actually).

7

One way to add this feature I am talking about would be to add the negate ‘!’ character to the log rule regex parameter, just like you exclude topics:

/system logging
add action=email regex=!"ntp change time",!"some other log message to exclude" topics=critical

It would be great to have this feature so you can catch all critical/error log entries except ones with specified messages.

8

Is a nice idea, write to support@mikrotik.com

9

Thanks for the idea rextended
I was unable to print firewall log lines contain "proto UDP" only but exclude lines contain "docker".
(I even made research with AI)
Now I have a command that works :slight_smile:

/log/print where topics~"firewall" &&  message~"proto UDP" && !(message~"docker")
10

So, does this mean that (as of ROS 7.23.1) we still cannot set up /system/logging to log all ssld,error EXCEPT for the now-frequent and useless (and, consuming flash disk writes) "ssl: record overflow" and "ssld: peer suggested unsupported TLS version" messages?

(ssld logging, or, at least, much more frequent ssld logging, was added in a recent ROS 7.20something version, and it does meaningfully increase the number of "error" log entries, which do by default get written to persistent disk storage).