I’ve got an issue when trying to write logs to a remote host and I don’t know if it is my device\routerOS or if it is my configuration; but I cannot seem to log more than one topic to a remote host or one action, and enabling more than one topic will just disable all logging, at least on that rule. This is complicated by the fact that I can’t seem to get USB devices to work properly. I can get them to work/recognize the device initially but after some period of time they disappear and the USB device is dead and can no longer be read by any other computer. I’ve burned up 4-5 flashdrives this way. Anyone have any ideas? I’ve read the wiki entries on logging (and USB) and have not really found anything useful. Am I missing something?
Each topic that you want logged will need it’s own logging entry. If you want everything logged to the remote enter
add action=remote topics=debug
This results in like 1.2M syslog messages per hour. I think I figured it out; Needed to open additional ports on the syslog host and then setup actions on the host to receive on the ports in use, and then on the RB3011 add a separate action for each topic. It’s working at least for the time being but it doesn’t seem that efficient.
EDIT: this might be an exaggeration. I tried this before and I ended up with like 3.5M messages in 8 hours. I only know because it was written to a database and could see the row count.
You can narrow down what you want logged. Each topic can be listed which the amount of data you want. I.e.
DNS debug, packet, info, warning, critical