What \system logging configuration is appropriate for an edgerouter

RouterOS Security
1

The RB4011iGS+5HacQ2HnD router at the edge of the network connects the company to the ISP. Until tonight logging has always been configured:

/system logging
add

A miss configuration in the ISP network started flooding the log files with

2026-05-28 16:58:23 pppoe,debug,packet ether1: rcvd PADI from 4A:00:3E:BE:18:E1
2026-05-28 16:58:23 pppoe,debug,packet session-id=0x0000
2026-05-28 16:58:23 pppoe,debug,packet service-name=
2026-05-28 16:58:23 pppoe,debug,packet unknown(0)=
2026-05-28 16:58:23 pppoe,debug ether1: dropping PADI: no service to offer

every six seconds. The issue started on May 26 just after a pppoe failure (according to logs). Th ISP investigated the issue and since it is not service impacting, they are closing the ticket. Unfortunately, the the entries the misconfiguration generates is filling the log files on the router.

I made the following changes to logging.

[admin@edgerouter] > /system logging print
Flags: * - DEFAULT
Columns: TOPICS, ACTION

0 * info memory
1 * error memory
2 * warning memory
3 * critical echo
4 critical memory
5 interface memory
6 ppp memory
7 critical disk
8 error disk
9 pppoe memory
info
10 ppp memory
info

Is this is sufficient or should there be more/less. The change has removed the above persistent logging but what am I missing. I hate to discover later I needed more logging to investigate an issue.

2

When pppoe starts having issues, it tends to fill up the log, and you lose everything else.

I would probably make a memory2 logging action.

And then change the logging so the PPPoE traffic goes only to the new destination, ignores debug stuff, and no longer goes to the memory destination. Then it doesn't overwrite your other logging, and you get to see the last few pppoe logs even if very old.

Perhaps:

/system logging action
add memory-lines=500 name=memory2 target=memory

/system logging
set [find where topics~"info" and default=yes] topics="info,!pppoe"
add action=memory2 topics=pppoe,!debug

Note: If you already have other filters on the default info topic, you are likely better to change it in winbox.

3

Thank you for the response. pppoe log overflow is how I wound up on this path. Thank you for the share.