Page 1 of 1

Loging not working with multiple topics?

Posted: Tue Jul 09, 2019 10:10 am
by rclc
Logging not working? whats wrong? I am trying to save error, warning and info to an SD card, take a look:
*When i chose only one ( only info or only error) it work!
[R1@w] > system logging print       
Flags: X - disabled, I - invalid, * - default 
 #    TOPICS                                                    ACTION                                                    PREFIX    
 0  * info                                                      memory                                                              
 1  * error                                                     memory                                                              
 2  * warning                                                   memory                                                              
 3  * critical                                                  echo                                                                
 4    error                                                     logtosd                                                             
      warning                                                  
      info                                                     
[R1@wollf] > system logging action print
Flags: * - default 
 0 * name="memory" target=memory memory-lines=2000 memory-stop-on-full=no 
 1 * name="disk" target=disk disk-file-name="log" disk-lines-per-file=1000 disk-file-count=2 disk-stop-on-full=no 
 2 * name="echo" target=echo remember=yes 
 3 * name="remote" target=remote remote=0.0.0.0 remote-port=514 src-address=0.0.0.0 bsd-syslog=no syslog-time-format=bsd-syslog 
     syslog-facility=daemon syslog-severity=auto 
 4   name="logtosd" target=disk disk-file-name="/disk1/logs/log" disk-lines-per-file=8192 disk-file-count=100 disk-stop-on-full=no 

Re: Loging not working with multiple topics?

Posted: Tue Jul 09, 2019 10:44 am
by mrz
logging expects that log entry will have all three of those topics. I have never seen log entry with topics, for example "info,warning,error,firewall" .
Logic is "info and warning and error"

If you want to log all three occurrences, then you need to add three separate rules.

Re: Loging not working with multiple topics?

Posted: Tue Jul 09, 2019 10:48 am
by Jotne
Try this workaround.

Send all that its not debug to sd.

Here are what I do use to send logs to Splunk logging server. (see my signature)
/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!debug
If you want debug as well, try some that you do not use like UPS
/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!ups
or as @mrz writes, one rule pr topic to log.

Re: Loging not working with multiple topics?

Posted: Fri Jul 12, 2019 5:35 am
by rclc
logging expects that log entry will have all three of those topics. I have never seen log entry with topics, for example "info,warning,error,firewall" .
Logic is "info and warning and error"

If you want to log all three occurrences, then you need to add three separate rules.
Manual is outdated?
There is an example on manual see Logging configuration: https://wiki.mikrotik.com/wiki/Manual:System/Log
Try this workaround.

Send all that its not debug to sd.

Here are what I do use to send logs to Splunk logging server. (see my signature)
/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!debug
If you want debug as well, try some that you do not use like UPS
/system logging
set 0 disabled=yes
add action=remote prefix=MikroTik topics=!ups
or as @mrz writes, one rule pr topic to log.
!debug seems a good workaround, let's see one day file size.
It also work with topics=!debug,!dns,!<topic>

Re: Loging not working with multiple topics?

Posted: Fri Jul 12, 2019 11:44 am
by mrz
Not outdated, I do not see example with topics="error,warning,info"

Re: Loging not working with multiple topics?

Posted: Fri Jul 12, 2019 9:06 pm
by rclc
Not outdated, I do not see example with topics="error,warning,info"
/system logging add topics=ntp,debug,!packet

Re: Loging not working with multiple topics?

Posted: Fri Jul 12, 2019 10:08 pm
by Jotne
Warning!!!!

Mixing various logs in on line and you do not get what you want.
This:
/system logging print detail
Flags: X - disabled, I - invalid, * - default
 1    topics=dhcp,hotspot,!debug prefix="MikroTik" action=remote
are not the same as this:
/system logging print detail
Flags: X - disabled, I - invalid, * - default
 1    topics=dhcp prefix="MikroTik" action=remote
 2    topics=hotspot prefix="MikroTik" action=remote
 3    topics=!debug prefix="MikroTik" action=remote
The first one is AND and will give you/me nothing.
Second one is OR and give me all dhcp logs, all hostspot logs and all other that are not debug logs

Re: Loging not working with multiple topics?

Posted: Mon Jul 15, 2019 3:04 pm
by mrz
Not outdated, I do not see example with topics="error,warning,info"
/system logging add topics=ntp,debug,!packet
This is completely different of what you have configured.

Example in wiki will log all log entries with topics ntp AND debug AND NOT packet, in short NTP debug packets.

Re: Loging not working with multiple topics?

Posted: Mon Jul 15, 2019 3:41 pm
by rclc
Not outdated, I do not see example with topics="error,warning,info"
/system logging add topics=ntp,debug,!packet
This is completely different of what you have configured.

Example in wiki will log all log entries with topics ntp AND debug AND NOT packet, in short NTP debug packets.
I'm not understanding, which logic is that. I did /system logging add topics=error,warning,info action=logtosd

Re: Loging not working with multiple topics?

Posted: Mon Jul 15, 2019 3:59 pm
by mrz
As I mentioned log message with topic "error AND warning AND info" does not exist in real world.
Just look at your log messages and see how topics are used, then you will understand.