Loging not working with multiple topics?

RouterOS General
1

Logging not working? whats wrong? I am trying to save error, warning and info to an SD card, take a look:
*When i chose only one ( only info or only error) it work!

[R1@w] > system logging print       
Flags: X - disabled, I - invalid, * - default 
 #    TOPICS                                                    ACTION                                                    PREFIX    
 0  * info                                                      memory                                                              
 1  * error                                                     memory                                                              
 2  * warning                                                   memory                                                              
 3  * critical                                                  echo                                                                
 4    error                                                     logtosd                                                             
      warning                                                  
      info                                                     
[R1@wollf] > system logging action print
Flags: * - default 
 0 * name="memory" target=memory memory-lines=2000 memory-stop-on-full=no 
 1 * name="disk" target=disk disk-file-name="log" disk-lines-per-file=1000 disk-file-count=2 disk-stop-on-full=no 
 2 * name="echo" target=echo remember=yes 
 3 * name="remote" target=remote remote=0.0.0.0 remote-port=514 src-address=0.0.0.0 bsd-syslog=no syslog-time-format=bsd-syslog 
     syslog-facility=daemon syslog-severity=auto 
 4   name="logtosd" target=disk disk-file-name="/disk1/logs/log" disk-lines-per-file=8192 disk-file-count=100 disk-stop-on-full=no
2

logging expects that log entry will have all three of those topics. I have never seen log entry with topics, for example “info,warning,error,firewall” .
Logic is “info and warning and error”

If you want to log all three occurrences, then you need to add three separate rules.

3

Try this workaround.

Send all that its not debug to sd.

Here are what I do use to send logs to Splunk logging server. (see my signature)

/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!debug

If you want debug as well, try some that you do not use like UPS

/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!ups

or as @mrz writes, one rule pr topic to log.

4

Manual is outdated?
There is an example on manual see Logging configuration: https://wiki.mikrotik.com/wiki/Manual:System/Log

!debug seems a good workaround, let’s see one day file size.
It also work with topics=!debug,!dns,!

5

Not outdated, I do not see example with topics=“error,warning,info”

6

/system logging add topics=ntp,debug,!packet

7

Warning!!!

Mixing various logs in on line and you do not get what you want.
This:

/system logging print detail
Flags: X - disabled, I - invalid, * - default
 1    topics=dhcp,hotspot,!debug prefix="MikroTik" action=remote

are not the same as this:

/system logging print detail
Flags: X - disabled, I - invalid, * - default
 1    topics=dhcp prefix="MikroTik" action=remote
 2    topics=hotspot prefix="MikroTik" action=remote
 3    topics=!debug prefix="MikroTik" action=remote

The first one is AND and will give you/me nothing.
Second one is OR and give me all dhcp logs, all hostspot logs and all other that are not debug logs

8

This is completely different of what you have configured.

Example in wiki will log all log entries with topics ntp AND debug AND NOT packet, in short NTP debug packets.

9

I’m not understanding, which logic is that. I did /system logging add topics=error,warning,info action=logtosd

10

As I mentioned log message with topic “error AND warning AND info” does not exist in real world.
Just look at your log messages and see how topics are used, then you will understand.