Is it possible to activate a script if certain keywords are mentioned in logs, for example "wrong peer state" or "master flag=false".

Something like this should be easily modified to do what you're asking: http://forum.mikrotik.com/viewtopic.php ... 6&#p314252

You'll have to schedule it to run as often as you want to check for new log items.

Something like this should be easily modified to do what you're asking: http://forum.mikrotik.com/viewtopic.php ... 6&#p314252

You'll have to schedule it to run as often as you want to check for new log items.

Thank you, I will edit and try, I was attempting to give Karma for the helpful post but cannot which is a pity as anyone who helps should be.

Tried the script but even after editing my email credentials, it did not send a email using the keywords included "login failure" and there several login failures listed in the logs, using both Ver5.20+ 6.2?

Is it possible to activate a script if certain keywords are mentioned in logs, for example "wrong peer state" or "master flag=false".

Do you need the email functionality? If you only want to run a script when keywords are found, the email function can be replaced with whatever script you want to run. If you want the email to work, make sure you have configured "/tool e-mail" settings...

I did some testing of the script on v6.2 and for whatever reason, the [:parse] functions were not working, so I removed them in the revised example below. Change this line to run your own script, or just replace it with whatever code you want:

ros code

/system script run myScript

ros code

:global lastTime;

:local currentBuf [ :toarray [ /log find message~"wrong peer state" || message~"master flag=false" ] ] ;
:local currentLineCount [ :len $currentBuf ] ;

if ($currentLineCount > 0) do={
   :local currentTime "$[ /log get [ :pick $currentBuf ($currentLineCount -1) ] time ]";

   :if ([:len $currentTime] = 15 ) do={
      :set currentTime [ :pick $currentTime 7 15 ];
   }
   
   :local output "$currentTime $[/log get [ :pick $currentBuf ($currentLineCount-1) ] message ]";
   
   :if (([:len $lastTime] < 1) || (([:len $lastTime] > 0) && ($lastTime != $currentTime))) do={
      :set lastTime $currentTime ;
      /system script run myScript
   }
}

@skot Thank you for assisting

First I setup the email script which works correctly and sends log.0.txt from files Saved this script as "RouterError"

I tried the revised code but it not picking up the keywords for example, from log.0.txt it has enteries like
Oct/05/2013 14:10:39 route,ospf,info new master flag=false
Sep/24/2013 03:22:57 system,error,critical login failure for user XXXXXX
and tried keyword "failure" as well

1. Check the System > Scripts > Environment tab. Does the lastTime variable show up? If so, remove it, and run the script again. Each time to run the script, if it finds a matching log with a different time stamp, this variable will change. If there are no "new" matching logs, then this will stay the same and no emails will be sent, so by removing it, it resets the process. For testing, you'll need to 1) remove this before each time you run the script or 2) generate a new matching log entry. 2. Another option is to replace the " /system script run RouterError" line with something like "/log info blah" for testing.

3. You can also put your email code directly into the script. The example below also searches for Failure and failure, and it emails the $output variable (the actual log message) as the email body (if you want that).

ros code

:global lastTime;
 
:local currentBuf [ :toarray [ /log find message~"new master flag=false" || message~"[Ff]ailure" ] ] ;
:local currentLineCount [ :len $currentBuf ] ;
 
if ($currentLineCount > 0) do={
   :local currentTime "$[ /log get [ :pick $currentBuf ($currentLineCount -1) ] time ]";
 
   :if ([:len $currentTime] = 15 ) do={
      :set currentTime [ :pick $currentTime 7 15 ];
   }
   
   :local output "$currentTime $[/log get [ :pick $currentBuf ($currentLineCount-1) ] message ]";
   
   :if (([:len $lastTime] < 1) || (([:len $lastTime] > 0) && ($lastTime != $currentTime))) do={
      :set lastTime $currentTime ;
      tool e-mail send server=xxx.xxx.xxx.xxx port=25 from=fromEmailAddress file=log.0.txt to=toEmailAddress subject=( "RouterError", [/system identity get name],[/system clock get time],[ /system clock get date]) body="$output"
   }
}

HTH

I really wish i could give Karma for all your help?

The script works OK now - Many thanks for your efforts on this,

Originally I thought if i had a script to detect keywords in the log to
(1) email
(2) reboot

But I am concerned the router on reboot could find the keywords again and go into reboot cycle even I had added delay after reboot?

I have set my logging of 1000 lines to disk and not memory,

1. Check the System > Scripts > Environment tab. Does the lastTime variable show up? If so, remove it, and run the script again. Each time to run the script, if it finds a matching log with a different time stamp, this variable will change. If there are no "new" matching logs, then this will stay the same and no emails will be sent, so by removing it, it resets the process. For testing, you'll need to 1) remove this before each time you run the script or 2) generate a new matching log entry.

Am I correct that if I have a reboot action on this script it not go into reboot loop if there is no new keywords are detected since time stamp of script > Environment tab

From email sent, it tells me time of keyword and with attached log file to examine for other issues,

14:21:56 new master flag=false,PTP_F30,21:07:44,oct/08/2013

Am I correct that if I have a reboot action on this script it not go into reboot loop if there is no new keywords are detected since time stamp of script > Environment tab

The global variable is stored in memory, so a reboot will clear it. So, I think it will go into a reboot loop.

This could be fixed by saving the time stamp in the comment of some permanent item (a user account comment, interface comment, wherever). Then the time stamp would survive a reboot. Example below, edited on line 1 and line 16.

ros code

:local lastTime [/user get [find name="userName"] comment];
  
:local currentBuf [ :toarray [ /log find message~"new master flag=false" || message~"[Ff]ailure" ] ] ;
:local currentLineCount [ :len $currentBuf ] ;
  
if ($currentLineCount > 0) do={
   :local currentTime "$[ /log get [ :pick $currentBuf ($currentLineCount -1) ] time ]";
  
   :if ([:len $currentTime] = 15 ) do={
      :set currentTime [ :pick $currentTime 7 15 ];
   }
    
   :local output "$currentTime $[/log get [ :pick $currentBuf ($currentLineCount-1) ] message ]";
    
   :if (([:len $lastTime] < 1) || (([:len $lastTime] > 0) && ($lastTime != $currentTime))) do={
      /user set [find name="userName"] comment=$currentTime
      tool e-mail send server=xxx.xxx.xxx.xxx port=25 from=fromEmailAddress file=log.0.txt to=toEmailAddress subject=( "RouterError", [/system identity get name],[/system clock get time],[ /system clock get date]) body="$output"
   }
}

The script appears to working OK and i added a second email address should primary not send, and thank you skot once again
If using user=admin ensure there is no comment already there like "Default User", clear this comment and leave blank.

To increase the possiblity of important log file keywords being received i used two email accounts.

I had planned to also add reboot router to script when keywords were listed in the logs but I now discover that while the script works,

But on a router which has several issue like no PPPoE profile local-address or DNS errors "No route to host" or OSPF "OSPFv2 neighbor 10.111.XX.XX: state change from full to 2-way
This occurs on APs which have used version V5.20 , V5.25, V6.1,

A simple reboot normally solves this but I am more concerned why this occuring in the first place - Time for a different post?
But the good news this time is that I currently have a test AP with these issues and have not rebooted,
So far as i have only mac-telnet access, i ran /system sup-output which has created supout.rif file,
What other tests can be done before i reboot to help MT support to fix this issue(s)?

But on a router which has several issue like no PPPoE profile local-address or DNS errors "No route to host" or OSPF "OSPFv2 neighbor 10.111.XX.XX: state change from full to 2-way
This occurs on APs which have used version V5.20 , V5.25, V6.1,

A simple reboot normally solves this but I am more concerned why this occuring in the first place - Time for a different post?
But the good news this time is that I currently have a test AP with these issues and have not rebooted,
So far as i have only mac-telnet access, i ran /system sup-output which has created supout.rif file,
What other tests can be done before i reboot to help MT support to fix this issue(s)?

I'm not quite understanding the new problem. Is it related to the script? Or something else? It might be good to start a new post...