Monitor Logs, Send Email Alert Or Run Script - MikroTik Script RouterOS
Description
This script monitors the logs for particular words/phrases, and then excludes results based on a second set of words/phrases. If new matching logs are found, an email is sent (or other code could be run)
v4 Changes
tested on v5.26 and v6.20
Script now catches all matching logs since the last detection.
Date/time checking updated to look for 3 possible formats.
Changed time stamp to now be date/time stamp
Instructions
Create a new schedule, and paste the script into the schedule. Set the duration to how often you want to check for new logs.
Change this to the name of your schedule (the date/time stamp is saved in the schedule's comment).
:local scheduleName "mySchedule"
Put your email address here.
:local emailAddress "email@domain.com"
This currently detects two strings. It can be changed to more or less strings if desired. Remove: || message~"login failure" if you only want to use one string, or if you want more strings, add this same code at the end (but before the last two end brackets).
:local startBuf [:toarray [/log find message~"logged in" || message~"login failure"]]
Edit the quoted items for strings you want to be filtered out of the results. For example, if you want all "logged in" logs found, but you do not want any of the "logged in via telnet" logs included, simply include the word "telnet" in the array and these logs will be excluded. Double quote additional strings and separate them with semi-colons. If you don't want any logs filtered, simply declare the variable :local removeThese without any curly braces.
:local removeThese {"telnet";"whatever string you want"}
The Script
:local scheduleName "mySchedule"
:local emailAddress "user@email.com"
:local startBuf [:toarray [/log find message~"logged in" || message~"login failure"]]
:local removeThese {"telnet";"whatever string you want"}
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
/log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name"
}
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
:local currentTime
:local message
:local output
:local keepOutput false
:if ([:len $lastTime] = 0) do={
:set keepOutput true
}
:local counter 0
:foreach i in=$startBuf do={
:local keepLog true
:foreach j in=$removeThese do={
:if ([/log get $i message] ~ "$j") do={
:set keepLog false
}
}
:if ($keepLog = true) do={
:set message [/log get $i message]
:set currentTime [ /log get $i time ]
:if ([:len $currentTime] = 8 ) do={
:set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
} else={
:if ([:len $currentTime] = 15 ) do={
:set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
}
}
:if ($keepOutput = true) do={
:set output ($output.$currentTime." ".$message."\r")
}
:if ($currentTime = $lastTime) do={
:set keepOutput true
:set output ""
}
}
:if ($counter = ([:len $startBuf]-1)) do={
:if ($keepOutput = false) do={
:if ([:len $message] > 0) do={
:set output ($output.$currentTime." ".$message."\r")
}
}
}
:set counter ($counter + 1)
}
if ([:len $output] > 0) do={
/system scheduler set [find name="$scheduleName"] comment=$currentTime
/tool e-mail send to="$emailAddress" subject="MikroTik alert $currentTime" body="$output"
/log info "[LOGMON] New logs found, send email"
}
Other Notes
If you would rather run a script or whatever (instead of sending email), simply remove the email config line at the top, and change the "/tool email" line near the bottom to do whatever you want.
Credit: wiki.mikrotik.com