Using Splunk to analyse MikroTik logs

RouterOS General
41

Post #1 updated with a tutorial on how to get it working.

42

Nice. I think you need to talk to xoff about getting this published through the Splunk Appbase.

43

Took little test yesterday. Great tool for log analysis. One big problem for free licence, no email alerts :frowning:

44

I agree with you.
There is a workaround. You can request a 6 month Developer licence.
Its free, and you get full function for 6 month.
10GB/day
Alert
+++
But its only for 6 month…

45

Where´s the “Mikrotik.zip” file? The attachment does not exist anymore. Could you sent it again?

46

I have added the file, so it should work now.
Why it stopped work, I do not now.

47

wow !! you did a great job. I’ve implemented it. Firewall data usage is not working for me. You mentioned to use the private key. which one is the private key? all i can see only id_dsa and id_dsa.pub

48

The ****

.pub

stands for public which you place to the servers to which you want to log in without entering a password.
So you normally generate the pair of private and public key at the client machine in the ****

~/.ssh/

directory of the user from which you are going to log in to the server, and copy only the

.pub

file to the server (the Mikrotik in this case). As @Jotne says to copy the private key to Mikrotik/bin on the Splunk machine, that would be the

id_dsa

file without

.pub

suffix.

49

Yeah thanks. But even so Mikrotik asks for a password. So I found a different way to do it. Everything is working fine except the DNS logs. Was working since i made changes i think, and DNS logs are not getting in.

50

DNS logs comes for Syslog, so if you get other sylog data, you should also get DNS.
What is your logging settings?

I have two settings in my remote syslog settings.

add action=remote prefix=MikroTik topics=dhcp
add action=remote prefix=MikroTik topics=!debug,!snmp

First line sends all DHCP message, including debug message.

Second line sends all message that are not debug nor SNMP.
I do not need the SNMP, nor the debug message from other modules.
This gives me logs from other modules like DNS,Firewall, System, upnp, Interface etc


PS, I am working on a new version that gives log information for booth wireless and hotspot.
Since hotspot only shows message for logout as default, you should also get debug message from they as well and do like this:

add action=remote prefix=MikroTik topics=dhcp,hotspot
add action=remote prefix=MikroTik topics=!debug,!snmp
51

@Jotne
I like your solution and examples in Splunk . I think that I followed your instruction, but I still have in Mikrotik App

“No results found.”

Can you please help me to find what I’m doing wrong ?

Thanks in advance.

52

Splunk should recieve data if Mikrotik is correctly setup, even if the Mikrotik app is not installed.

What is important.

  1. Make sure your device sends syslog messages.
add name=Server_Name remote=192.168.1.x target=remote
add action=remote prefix=MikroTik topics=dhcp,hotspot
add action=remote prefix=MikroTik topics=!debug,!snmp

This should sends at least information on changes and some other logs.

  1. Make sure no fw blocks the data entering your server.

  2. Enable Splunk to receive the sylog

Then a search like this should give you data.

http://your-server:8000/en-GB/app/search/search?q=search%20*
53

Sure, that’s all is working.
I see this data in splunk stream and I can browse them.

The problem is that on Mikrotik Application there is nothing.
Same problem like before : “No results found.”
Zrzut ekranu 2018-04-02 o 17.35.32.png

54

Go to search and write * to do a general search.
Past some line here, so I do see how it looks like.

You may not have tagged rules with MikroTik (NB upper M and upper T)

prefix=MikroTik
55

Thanks!
Yes, “Mikrotik” vs. “MikroTik” - works, with following :

  • MikroTik DNS Live usage
  • MikroTik DNS request
  • MikroTik Firewall

but is not working with following:

  • MikroTik Volt/Temperature
  • MikroTik Live attack - I have to add name to rule “FW_Drop_all_from_WAN”
  • MikroTik Web Proxy - but currently I’m not using proxy
  • MikroTik DHCP request - where to add debug messages?
  • Mikrotik DHCP pool information - how to run ?
  • MikroTik remote connection - like VPN ?
  • MikroTik Firewall data usage - SSH ? (how to run this?)
  • MikroTik uPnP - SSH (how to run this?)

Can you please advise me how to run this ?

56

Lots of the stuff you are missing some rules.
That is some my fault, that data i depended rules, that need names.

Click on the magnifier glass under the graph and se where data is coming from.

Live logs need a rule with correct name, look at search. (third line)

sourcetype=mikrotik
          module=firewall
          rule=FW_Drop_all_from_WAN
          | search dest_port=*
          | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_host
          | iplocation src_ip
          | eval City=if(isnull(City) OR City="", "Unknown", City)
           ,src_host=if(isnull(src_host) OR src_host="", src_ip, src_host)
           ,info=src_host."-".City."-".Country."-".dest_port.":".protocol
           | geostats globallimit=0 count by info

Live log need this as the last FW rules.

add action=drop chain=input comment="Drop all from WAN " in-interface=ether1-Wan log=yes log-prefix=FW_Drop_all_from_WAN

Volt/Temperature
source=“snmp://MikroTik-info”
Needs SNMP working. (Splunk asks using SNMP to get data)

DHCP request
Seems that some has change in MikroTik logging, so remove logging rules ans change to

add action=remote prefix=MikroTik topics=!debug,!snmp

DHCP pool information
Need SNMP to work

MikroTik Remote connection.
This should show VPN, but some has change in the logging.
Remove “severity=info” from the section “3. VPN logged in ok”

SSH is explained in the frist post.

Get data from MikroTik with SSH (does only work with Linux Splunk version)
https://wiki.mikrotik.com/wiki/Use_SSH_ … key_login)
Add the private key to the folder: MikroTik\bin
Change script in MikroTik\bin to use correct key and IP

57

Hi Jotne,

Can you please update the links to download, really it doesn´t work, and congratullations for this great job!!

58

Link in first post works fine.

59

@Jotne,

Can you please help me setup log analyze for hotspot user.

http://forum.mikrotik.com/t/how-to-capture-hotspot-user-log/119573/1

60

First, thank you for all the work you have done.

All views are working with the exception of DHCP pool info. mikrotik_dhcp_pool_information.sh seems to be calling a script that simply doesn’t exist on my MikroTik device:

/system script run DHCP-Pool-information

As per your reply above, SNMP is working as I get volt/temp info after editing defaults/inputs.conf to match my device. I don’t see any info in first post about adding the above script to RouterOS. Where might I get that code?