Sanity check something for me. Log on my RB4011iGS+ (ROS 6.49.6 at the moment) writes between 1000 and 2000 log entries per day. The vast majority of those only write to memory with a much smaller number writing to disk. My understanding of the way different types of memory work is that writing that many log entries to memory is not a problem, but if I were to write all those to disk, that would have an substantial affect on disk life. If I wanted to keep all the log entries it would be better to write to a remote syslog server. And yes, I have read Jotne’s writeup on using Splunk: http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-4-0-graphing-everything/153043/1
And the question ? Seems like you already answered it yourself.
Am I correct in my understanding?
Yes?
Use external syslog or external USB device, if possible.
Yes but as usual, things need to be considered in context.
See here (old stuff but it’s definitely not becoming worse)
https://wiki.mikrotik.com/wiki/Manual:RouterBOARD_bad_blocks
http://forum.mikrotik.com/t/sector-writes-how-big-is-a-sector/55752/1
With 27 million (!!) writes per month, you still need about 20 years for 100 000 write cycles to be completed.
It is always considered better to write to devices which were designed for that purpose. If your MT has an external USB port, that’s a better option to write to. Syslog server, even better.
I have on service some board from 2007 when I open the WISP that use internal nand for user-manager (RB1100AH)…
That's was what I thought, but wanted to be sure. And of course, no external USB slot on the RB4011...
Working on a Splunk install on my server.