Using scriting to remove things

RouterOS Scripting
1

Hi all,

I’m pretty new to Mikrotik and so I’m still hitting walls with some basic things … like all the dark corners of scripting. The docs aren’t that bad, but mostly focus on adding things and not so much of removing them. Thus there are examples on how to add logging rule, for instance:

/system logging add topics=dhcp,info action=memory

But I’m struggling to remove this. WinBox won’t do for me, I want the config scripts to do cleanup before setting things. If they don’t, the rules for the same topics with the same action will just keep piling up. I managed to remove action using numbers=[find where name=”myname”but couldn’t find the appropriate numbers= expression to remote the rule? Yes, for custom actions it is possible to remove the action first and then remote the rules using it with [find invalid]but that won’t work for built in actions like memory that can’t be removed.

So please, anybody, how to write correct /system logging remove to delete the above rule?

2

Use a prefix instead of a name?
/system logging remove numbers=[find where prefix="test"]

Just think about how to ensure the uniqueness of a rule with the same topics and action

3

Generally, you can just reverse the attributes used in the add and use them in a remove [find ...]. find returns matching .id, and remove can take an *1 that can be used to remove. Now, RouterOS scripting has "types", so topics is an array type. So this one is a bit tricker to remove, as written in OP example. The answer is:

/system logging remove [find topics~"dhcp;info" action=memory]

This is because the find will internally :tostr the topics array, which gets ; separators which is presented to find as string. And, the ~, instead of =, just means use a regular express to do a substring search.

Often it helps to add a comment and look for that to remove.

But /system/logging does not have comment, so this does not work:

/system logging add topics=dhcp,info action=memory comment="dhcp log"
/system logging remove [find comment="dhcp log"]
This means you can change other settings in log rule, yet still remove it by a stable thing like comment.

EDIT: See later posts...

1 Like
4

topics is actually an array so if you want to match topics=dhcp,info you'll need to write the [find] condition similar to this

# this dump the item to shows that the correct item has been matched
:put [/system/logging/get [find where ((topics)->0)="dhcp" ((topics)->1)="info" ]]

So, to remove, you can use the command:

/system/logging/remove [find where ((topics)->0)="dhcp" ((topics)->1)="info"]

EDIT: I forgot about the conversion to string, so @Amm0's solution with topics~"dhcp;info" is better. However, in this case no comment can be set for /system/logging entries, so the solution with comment matching is not applicable.

1 Like
5

...

/system logging add topics=dhcp,info action=memory

/system logging remove [find topics=[:toarray "dhcp;info"] action=memory]

less complicated, and more closely resembles what was done to create it...

But the right way is to use comment... (see next posts)

ADDED later:
/system logging add topics=dhcp,info action=memory
is not the same as
/system logging add topics=info,dhcp action=memory

and on 2nd case must respect same order [:toarray "info;dhcp"]

1 Like
6

warning about use text editors: the only valid quotes is only " not ” or others.

7

All I know the poor OP did walk into one of the worse possible example of how to use remove.

and @rextended out did me. Now, I did realize after I could have use a $ and ^ in regex to cover all cases, and thought I'll let @rextended correct me :wink:

Now, I think generally using comment is best...

1 Like
8

Ok....

/system logging remove [find topics~"^(dhcp;info|info;dhcp)$" action=memory]

:rofl:

1 Like
9

Ha ha, in that case an exact string comparison also works

[find topics="dhcp;info" or topics="info;dhcp"]
1 Like
10

then if they become 3... the combinations become from 2 to 6, so it's better to use the comment field........ (see next posts)

11

yes, for sure,
but

topics~"^(dhcp;info|info;dhcp)$"

is shorter...

1 Like
12

Yes, comment is normally preferred, but items in this submenu have no comment field.

2 Likes
13

Hit and sunk...

immagine
immagine173×260 23.5 KB

I didn't know... in all these years I've never noticed...

Usually I clear-all-not-default, forced verbously set all setting on builtin to what I want and after that add the new rules.

14

Exactly my thought. I did it from memory, and didn't want to test the regex is why I left out the order/first/last things ;-).

15

For example, this is for v6.4x (set the default to... default values)

/system logging action
remove [find where default=no]
set 0 memory-lines=1000 memory-stop-on-full=no name=memory target=memory
set 1 disk-file-count=2 disk-file-name=/log disk-lines-per-file=1000 disk-stop-on-full=no name=disk target=disk
set 2 name=echo remember=yes target=echo
set 3 bsd-syslog=no name=remote remote=0.0.0.0 remote-port=514 src-address=0.0.0.0 syslog-facility=daemon \
    syslog-severity=auto syslog-time-format=bsd-syslog target=remote
add ...

/system logging
remove [find where default=no]
set 0 action=memory disabled=no prefix="" topics=info
set 1 action=memory disabled=no prefix="" topics=error
set 2 action=memory disabled=no prefix="" topics=warning
set 3 action=echo disabled=no prefix="" topics=critical
add ...

Now @safelogj must change again his post... :rofl:

16

Thank you all,

system logging remove numbers=[find where topics="dhcp;info"]

did the trick. And yes, unlike most of the rest this submenu does not have `comment` attribute, which I’d prefer, too.

Remove everything non-default would probably work, too, but if possible I prefer removing with more precision.

I’ll get there one day, but until then this forum is invaluable.

1 Like
17

You can/must remove numbers=

18

I don't change the messages, but I add to them if there's anything to add. U nose r extended again. Thanks to Carlo Lorenzini, everyone knows what that means.

19

It's a shame that on this forum there's a pencil mark, which indicates that a post has been edited.
And the moderators can see how it looked before.
You changed it, adding the line

Just think about how to ensure the uniqueness of a rule with the same topics and action

(and there's absolutely nothing wrong with that, especially since mine was just a joke, note the emoticon)

after you read that, about something needed to be written in the comment, on successive posts,
you at 07:15pm, after my post at 07:05pm [what I see on my browser] (where I write "But the right way is to use comment...").

But to avoid writing exactly the same thing, you implied that you were the user somehow must personalize the record.

And then liar about what? Where is the lie?

and where is the other one or the others?
After reading the other topic, I find why you wrote in that way:
Is about using third-party libraries without checking what's written inside, whether the code is an example and is used or not...

Whatever happens, it's certainly not you who judges whether I'm a liar or not, about something unspecified,
but all the users on the forum, who certainly count more than you.

Visible EDIT: I corrected some English meaning, which could be misleading, and added some comments.

20

There's a post on this forum where you call yourself paranoid and your date calculations are simply ridiculous. I added the advice about the importance of uniqueness after seeing a lot of (in my opinion) incorrect advice on using themes and actions, which I literally pointed out in my post. That's how it all is explained. And this is already your third lie :slight_smile: