Remote syslog not working

RouterOS General
1

I’m trying to setup remote logs for router which will be receiving local rsyslog server. Unfortunately router doesnt send logs to remote- memory, disk works but remote not. In WinBox visible only action like “memory”.
On the server side udp:514 rsyslog doesnt receive anything.
Considering that something might be wrong with the server, I used router’s PacketSniffer with cfg to capture anything going towards the server IP but capture is empty even memory type records are visible.
What I do wrong?

# mar/08/2018 19:49:28 by RouterOS 6.41.2
# software id = JGKK-JYGP
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 
/system logging action
set 1 disk-file-count=10
set 3 remote=192.168.0.101 src-address=192.168.0.254
add name=wifilog remote=192.168.0.101 src-address=192.168.0.254 target=remote
add name=dhcplog remote=192.168.0.101 src-address=192.168.0.254 target=remote
/system logging
add action=wifilog prefix=wireless topics=wireless,debug
add action=dhcplog disabled=yes topics=dhcp
add disabled=yes topics=ipsec
add disabled=yes topics=l2tp
add action=remote topics=critical
add action=remote topics=error
add action=remote topics=info
add action=remote topics=warning
2

To me the logging configuration seems just fine. Unless the Mikrotik’s own netmask is 25 or longer, check your firewall rules (filter/output, mangle, raw). Otherwise check also routing (if the netmask of 192.168.0.101 is 25 or longer, the 192.168.0.254 is in another subnet).

3

what do we miss if we save logs generally to a network filesystem like for example, DDWRT, OpenWRT, and tomato?

4

Is the memory portion of the last log lost?

5

thanx for comments, found error in rsyslog configuration. Used double quotes instead of single in $fromhost-ip

6

Congratulations, but how does that match the previous statement:

?

7

yes, that it is interesting part. I did setup fw rule to check if traffic is initiated by the router and goes towards server and saw it in log, but strange that Packet Sniffer router’s traffic not.
What I found also, that no need for FW rule for traffic originating from router (output).

8

That’s normal, the default action in each chain is “accept”, so if there is no rule at all in a chain, every packet is let through. See how the firewall works in the manual and in my supercharged summary.