Community discussions

MikroTik App
 
ZPrime
just joined
Topic Author
Posts: 22
Joined: Wed May 07, 2014 3:14 am

Filter or exclude certain log messages?

Mon May 02, 2022 11:23 pm

I don't believe this is possible, but I'm going to ask anyway...

Is there a way to prevent certain log entries based on Message content from going through a specific log Action?
I am exporting log entries to syslog on a LibreNMS server, and there are a few specific items we just don't care about...

For example -
We have an automated process that regularly logs in and out of all of our Mikrotiks. It uses the Mikrotik API
Each time it connects and then disconnects, I get Log entries for the login and logout event.

I want to ignore only the specific logins coming from one source IP via API.
I do still want to log all of the other login/logout events for security, I just don't care about the ones that are using the API and a specific source IP.

I know that I could just change the Logging Rule... We are currently using this:
/system logging add action=librenms topics=info,!firewall,!dhcp
If I added "!account" at the end of the Topics list, that would ignore ALL login/logout events... but we don't want that.
Just want to ignore events where the "Message" matches this regexp:
^user .* logged .* from 10.20.30.99 via api$
Again, I don't think this is currently possible (we are on the long-term chain), but I would love to be proven wrong. :wink:

It would be nice if the login "type" (API, SSH, Winbox, etc) was available as a Topic since I could then simply filter on that (wouldn't be perfect but would be better than what we have now).
 
ZPrime
just joined
Topic Author
Posts: 22
Joined: Wed May 07, 2014 3:14 am

Re: Filter or exclude certain log messages?

Tue May 03, 2022 3:11 am

Having a conversation with myself, but...
I was able to filter out the items I want to ignore at the syslog level on the linux server (it's running rsyslogd).

But it would still be nice to have a way for the Mikrotik to simply not send those messages to the syslog server at all...
 
User avatar
gilljr
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Thu Nov 15, 2012 10:47 pm
Location: Phoenix, AZ USA
Contact:

Re: Filter or exclude certain log messages?

Tue Jan 09, 2024 10:53 pm

I am also looking to do the same thing as you and have not figured out a way to do so. You are not talking to yourself, but I do not think there is a way to do this as the OS is currently restricted.

Who is online

Users browsing this forum: arm920t and 56 guests