script send email as user login into routerboard

Sat May 03, 2014 11:54 am

Hello, i want a script that send me a email if user login into routerboard.
Is that possible and where shall a run it?

rextended · Sun May 04, 2014 2:46 am

Hi,
thanks again for Karma for other script (http://forum.mikrotik.com/viewtopic.php ... 07#p423007)

About your request:

Login by?

You can see if one user (like admin) are logged from winbox with one command like:

:local HowManyAdminAreOnlineViaWinbox value=[:len [/user active find where name=admin and via="winbox"]]

NEVER FORGET THE QUOTES "" between the word after "via="

HowManyAdminAreOnlineViaWinbox can be "0" if no one user called "admin" are online (by winbox)
HowManyAdminAreOnlineViaWinbox can be "1" if only one user called "admin" are online (by winbox)
HowManyAdminAreOnlineViaWinbox can be "2" or more if more than one user called "admin" are online (by winbox, multiple winbox windows)

You can use also the keyword "local", "console", "telnet", "ssh", "api" and "web",
and you can know accordingly what method for access are used.

"New Terminal" inside WinBox, for example, are counted as second access via "local"

I hope this info suggest the right soluctions

For spimply have a list of user logged on that moment

:if ([:len [/user active find]] > 0) do {
 :local tmpMessage value="";
 :foreach tmpArrayItem in [/user active find] do {
  :set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n");
 };
 :log info message=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
};

By.

rextended · Sun May 04, 2014 3:04 am

Suggest after suggest... I made the script for you....

Schedule that script every appropriate time, like 10 seconds?

Syntax is for RouterOS 6.7+

:log info message=("Start Check Logged Users");
:local tmpAllTheUsersLogged value=[/user active find];
:if ([:len $tmpAllTheUsersLogged] > 0) do={
 :local tmpMessage value="";
 :foreach tmpArrayItem in=$tmpAllTheUsersLogged do={
  :set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n");
 };
 :set $tmpMessage value=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
 :if ($cluEmailSent != "true") do={
  :log info message=$tmpMessage;
  /tool e-mail send from="clu.script@routerboard.local" to="your@mail.it" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
  :global cluEmailSent value="true";
 };
} else={
 :global cluEmailSent value="false";
};
:log info message=("Check Logged Users End");

(Notice: a blank line on log after all user logged are normal, because \r\n at the end of each line)

You also must schedule this at startup of routerboard:

:global cluEmailSent value="false";

It prevents multiple sends of same email.
The email are sent again, when first logged users go to 0, and increase again.

Sun May 04, 2014 11:59 am

Hello Rextented, thx for reply and effort you deserve the karma
The script works like a charm

Tue May 13, 2014 11:42 am

@ rextended. Can you make a script if someone TRY to login on the routerboard?

rextended · Tue May 13, 2014 12:07 pm

@ rextended. Can you make a script if someone TRY to login on the routerboard?

Hmmm... wait two mins....

rextended · Tue May 13, 2014 12:12 pm

You can use this:

:put [/log find where message~"login failure"]

It give all ID of message in log rerarding failed login attempts,
store at boot this value on one :global variable and on scheduler check every x minutes if
previous global variable != [/log find where message~"login failure"]
if different send one email and update
and do not forget to update again the global variable with new value...

Some hint for you...

Tue May 13, 2014 12:27 pm

Thanks, can you give me the fully script to email please

rextended · Tue May 13, 2014 12:34 pm

Thanks, can you give me the fully script to email please

Have you find one personal assistant?

Ahahahaha!!!!

Ok, wait, I must write the script....

Tue May 13, 2014 12:39 pm

Thanks Rextended, its verry appriciated your help.

rextended · Tue May 13, 2014 12:43 pm

I made the script for you....

Schedule that script every appropriate time, like 10 seconds?

Syntax is for RouterOS 6.7+

:log info message=("Start Check Failed Login");
:local currentLoginFailureArray value=[/log find where message~"login failure"];
:if ($currentLoginFailureArray != $previosLoginFailureArray) do={
 :local tmpMessage value="";
 :foreach tmpArrayItem in=$currentLoginFailureArray do={
  :set $tmpMessage value=($tmpMessage.[/log get value-name=time $tmpArrayItem]." ".[/log get value-name=topic $tmpArrayItem]." ".[/log get value-name=message $tmpArrayItem]."\r\n");
 };
 :set $tmpMessage value=("Login Failure(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
 :log info message=$tmpMessage;
 /tool e-mail send from="clu.script@routerboard.local" to="your@mail.it" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
 :global previosLoginFailureArray value=$currentLoginFailureArray;
};
:log info message=("Check Failed Login End");

(Notice: a blank line on log after all log entry are normal, because \r\n at the end of each line)

You also must schedule this at startup of routerboard:

:global previosLoginFailureArray value=[/log find where message~"login failure"];

Mmm.. look familiar...

Tue May 13, 2014 2:26 pm

I'ts working perfect, thanks a lot rextended.
I give you karma if i can but must waiting

rextended · Tue May 13, 2014 7:09 pm

I just need to know if it working to you.

Thanks.

Tue May 13, 2014 7:18 pm

It's working fine thank you verry match

freemannnn · Fri Feb 06, 2015 12:32 pm

can someone confirm that the script above work in 6.26 ... "script if someone TRY to login on the routerboard"

For me does not work in 6.26

Fri Feb 06, 2015 8:39 pm

I have try and working fine with ROS 6.26

ebreyit · Fri Feb 06, 2015 10:56 pm

I use the logging function to email when a user logs into the routerboard.

Setup email, in the tools menu, the under logging create a new action, type email.

Then, add a new logging rule.
Topic: Account, Action 'Your new emailing action'

Now try logging in from winbox and you should receive an email.

freemannnn · Sat Feb 07, 2015 1:49 am

I use the logging function to email when a user logs into the routerboard.

Setup email, in the tools menu, the under logging create a new action, type email.

Then, add a new logging rule.
Topic: Account, Action 'Your new emailing action'

Now try logging in from winbox and you should receive an email.

this works for succefull login. i want to be emailed for failure login!

freemannnn · Sat Feb 07, 2015 1:54 am

thanx i just did it. i just have to select in topics "critical" and put to prefix "login failure".
very nice without script!

ubikrotik · Sun Mar 25, 2018 10:35 pm

I made the script for you....

Schedule that script every appropriate time, like 10 seconds?

Syntax is for RouterOS 6.7+

:log info message=("Start Check Failed Login");
:local currentLoginFailureArray value=[/log find where message~"login failure"];
:if ($currentLoginFailureArray != $previosLoginFailureArray) do={
 :local tmpMessage value="";
 :foreach tmpArrayItem in=$currentLoginFailureArray do={
  :set $tmpMessage value=($tmpMessage.[/log get value-name=time $tmpArrayItem]." ".[/log get value-name=topic $tmpArrayItem]." ".[/log get value-name=message $tmpArrayItem]."\r\n");
 };
 :set $tmpMessage value=("Login Failure(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
 :log info message=$tmpMessage;
 /tool e-mail send from="clu.script@routerboard.local" to="your@mail.it" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
 :global previosLoginFailureArray value=$currentLoginFailureArray;
};
:log info message=("Check Failed Login End");

(Notice: a blank line on log after all log entry are normal, because \r\n at the end of each line)

You also must schedule this at startup of routerboard:

:global previosLoginFailureArray value=[/log find where message~"login failure"];

Mmm.. look familiar...

hi,your script is working fine, but when I run it 3-4 times, my 750upr2 get 100% of cpu occupation then crash and reboot.

Anyone got this?

ubikrotik · Sun Mar 25, 2018 10:37 pm

thanx i just did it. i just have to select in topics "critical" and put to prefix "login failure".
very nice without script!

Also working fine, but there is no body and subject

ubikrotik · Sun Mar 25, 2018 11:01 pm

I have a new way to do that without full script.

Is it possible to send by eamil only new files once written?

Sun Mar 25, 2018 11:16 pm

Can you post the script ore solution on the forum please?
Thanks

ubikrotik · Mon Mar 26, 2018 12:03 am

yes,

just creat a new action under logging like our friends said in this post. But instead of email the rule, store it to the disk.

Now I would like to email this file only if it's new (maybe by looking at ''creation date'')

Actually I run both, email when rule is triggered it send an email, plus, send a copy of the file by eamil every day.

it works but can be more reliable I think.

ubikrotik · Mon Mar 26, 2018 6:04 am

i realized that there is not much information when it stored to the disk. So the solution is not very usefull.

offlinejke · Wed May 06, 2020 12:24 pm

Hi guys!
I used this script:
:log info message=("Start Check Logged Users");
:local tmpAllTheUsersLogged value=[/user active find];
:if ([:len $tmpAllTheUsersLogged] > 0) do={
:local tmpMessage value="";
:foreach tmpArrayItem in=$tmpAllTheUsersLogged do={
:set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n");
};
:set $tmpMessage value=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
:if ($cluEmailSent != "true") do={
:log info message=$tmpMessage;
/tool e-mail send from="clu.script@routerboard.local" to="your@mail.it" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
:global cluEmailSent value="true";
};
} else={
:global cluEmailSent value="false";
};
:log info message=("Check Logged Users End");

Also add to scheduler:
:global cluEmailSent value="false";

But my router sends me same email with same user login each time the script starts.
How to fix this?

offlinejke · Wed May 06, 2020 12:30 pm

Is it possible to change the script to send an email only once when the user logs in and that's it, and not send these messages anymore that he is logged in or active?

Jotne · Wed May 06, 2020 2:12 pm

Its possible by setting an gloabal variable with history of the user logged inn, but would be some complicated.

You can also look at my Splunk project in my signature. There you can see in an external app all logged in user/when and get it nice graphed.

Wed May 06, 2020 2:38 pm

I Delete :global cluEmailSent value="false"; in the script and everything looks fine to me.
I only get 1 email
Greatings

offlinejke · Sun May 10, 2020 4:45 pm

I Delete :global cluEmailSent value="false"; in the script and everything looks fine to me.
I only get 1 email
Greatings

Hi plisken.
Can you please share with me your script? An identical script cannot work for you, but for me not.

Mon May 11, 2020 11:26 am

This is the working script, but don't forget to setup the email settings in "tools" "email".

:log info message=("Start Check Logged Users");
:local tmpAllTheUsersLogged value=[/user active find];
:if ([:len $tmpAllTheUsersLogged] > 0) do={
:local tmpMessage value="";
:foreach tmpArrayItem in=$tmpAllTheUsersLogged do={
:set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n");
};
:set $tmpMessage value=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
:if ($cluEmailSent != "true") do={
:log info message=$tmpMessage;
/tool e-mail send from="youreemail@test.com" to="youremail@test.com" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
:global cluEmailSent value="true";
};
} else={
:global cluEmailSent value="false";
};
:log info message=("Check Logged Users End");

Jotne · Mon May 11, 2020 4:19 pm

Same script, with tabs and without not needed semicolon.

:log info message=("Start Check Logged Users")
:local tmpAllTheUsersLogged value=[/user active find]
:if ([:len $tmpAllTheUsersLogged] > 0) do={
	:local tmpMessage value=""
		:foreach tmpArrayItem in=$tmpAllTheUsersLogged do={
			:set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n")
		}
	:set $tmpMessage value=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage)
	:if ($cluEmailSent != "true") do={
		:log info message=$tmpMessage
		/tool e-mail send from="youreemail@test.com" to="youremail@test.com" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage
		:global cluEmailSent value="true"
	}
} else={
	:global cluEmailSent value="false"
}
:log info message=("Check Logged Users End")

JmeLche · Thu May 14, 2020 11:54 am

Hi, how to use iCloud or Gmail for notifications ?
I`m new user here, thanks!

Jotne · Thu May 14, 2020 3:59 pm

Google search is a nice tool to find these types of stuff.

Example here:
https://wiki.mikrotik.com/wiki/Manual:Tools/email

offlinejke · Mon May 18, 2020 5:36 pm

Thank you, but this script does not work for me as it should.
Though I delete: global cluEmailSent value = "false"; the email is still sent every time the script is triggered and letters are sent until the user logs out.
Probably it's time to tie up with the idea of a script and go look for other options.
Thank you guys for your attention.

This is the working script, but don't forget to setup the email settings in "tools" "email".

:log info message=("Start Check Logged Users");
:local tmpAllTheUsersLogged value=[/user active find];
:if ([:len $tmpAllTheUsersLogged] > 0) do={
:local tmpMessage value="";
:foreach tmpArrayItem in=$tmpAllTheUsersLogged do={
:set $tmpMessage value=($tmpMessage.[/user active get value-name=name $tmpArrayItem]." logged from ".[/user active get value-name=when $tmpArrayItem]." via ".[/user active get value-name=via $tmpArrayItem]."\r\n");
};
:set $tmpMessage value=("Logged user(s) ".[/system clock get date]." ".[/system clock get time]."\r\n".$tmpMessage);
:if ($cluEmailSent != "true") do={
:log info message=$tmpMessage;
/tool e-mail send from="youreemail@test.com" to="youremail@test.com" subject=("Logged user(s) report of ".[/system clock get date]." ".[/system clock get time]) body=$tmpMessage;
:global cluEmailSent value="true";
};
} else={
:global cluEmailSent value="false";
};
:log info message=("Check Logged Users End");