SysLog

RouterOS General
1

Good day! There is a small network. One broadcast domain without vlan. There is a log collector. but Mikrotik intensely refuses to send him. There is no firewall on the collector
Actions:

/system logging action print
name="rsyslog" target=remote remote=192.168.50.5 remote-port=514 src-address=0.0.0.0 bsd-syslog=no syslog-time-format=bsd-syslog syslog-facility=daemon syslog-severity=auto

Rules:

topics=info,error,critical,system,event,warning,script,wireless,dhcp,ipsec prefix="" action=remote

LogCollector on Centos 7(x64)
/etc/rsyslog.d/server.conf

# UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514

Used tсpdump but it is empty.
Version RouterOS 6.47. in earlier versions the same.

2

You need to add into firewall on “output” chain an ACCEPT for traffic to your IP of syslog server …

3

Thank. But the OUTPUT table. This refers to outgoing traffic from the server. In this case, syslog.
In Syslog server empty firewall and default policy is ACCEPT
From Mikrotik to LAN default policy ACCEPT without any rules.

4

When I test with telnet. Connecting to the syslog port (514). the server answers me. even makes an entry in the event log. And also on tcpdump the incoming traffic is visible

5

A message has to contain all topics to match. That’s an impossible combination, even info and error are exclusive to each other. Try this:

/system logging
add action=remote topics=info
add action=remote topics=error
add action=remote topics=warning
add action=remote topics=critical
6

Thank you so much. Works.

probably worth writing in support. since this is a bug

7

No, this is not a bug. Why do you think so?

8

I see no reason for each topic to write a rule. If for example I have two remote syslog servers.

9

As said before a message has to match all topics given in a rule. So you can use something like this…

/system logging add action=remote topics=info,dhcp

… to match all messages that have topic info and dhcp.

But there is no message that has topics error and info at the same time. So a rule like this will never match.

Well, you could try something like this for a single rule…

/system logging add action=remote topics=!debug