Outbound connections

I need to log outbound connections to see who is abusing the internet policy. How would I go about this?

Use Firewall. Log all the output chain.

/ip firewall filter add chain=output action=log

Something like this

M.