Why go through the manager
A MikroTik router can send syslog to Graylog on its own, but its default remote format has no host name. Graylog then knows the router only by its IP address, and a router behind NAT or on a changing address is hard to tell apart from the next one.
When the manager forwards the lines, each one carries the router's name as it is in the manager, and Graylog shows it as the source. You search and group by router name, the same names you see in the manager.
By default the manager keeps the latest 10,000 lines per device. Graylog keeps them as long as its index set is configured to, next to the logs of everything else on your network.
What you need
- MikroTik Manager v2.0.0 or newer, with routers already sending syslog to it (see Logs).
- Graylog 7.2 or newer that the manager can reach over UDP. The content pack was checked on Graylog 7.2.1.
- An admin account in Graylog, to create an input and install a content pack.
File
| File | What it does |
|---|---|
mikr_graylog_content_pack.json | A content pack with the MikroTik (mikr) stream and the MikroTik (mikr) dashboard. It creates no input, so it never clashes with one you already have. |
Setting it up
1. Create an input. In Graylog, under System → Inputs, launch a Syslog UDP input on port 1514. Graylog usually does not run as root, so it cannot listen on 514. If you already have a Syslog UDP input, use that one and its port.
2. Forward from the manager. In Settings → Syslog, turn on Forward to other collectors and add a collector with the Graylog address and the input's port. Leave its level at debug or info. Sign-ins and configuration changes are logged by RouterOS at the info level, so a higher setting keeps them away from Graylog. More under Forwarding to other collectors.
3. Install the content pack. Under System → Content Packs, upload the file and install it. It asks for one value, MikroTik Manager address: the address the manager's lines come from as Graylog sees it. The stream takes every line from that address. When the manager runs in Docker, that is usually the address of the host it runs on.
4. Start the stream. Graylog creates the MikroTik (mikr) stream paused. Start it under Streams. Until then it collects nothing and the dashboard stays empty.
5. Check it. Sign in to a router over SSH with a wrong password. Within a minute the dashboard should show it under Failed sign-ins, with the router's name as the source.
If nothing arrives, search all messages for the router's name. A line that is in Graylog but not in the stream came from a different address than the one you gave in step 3. Graylog shows the address a line came from in its gl2_remote_ip field.
The dashboard
| Widget | What it shows |
|---|---|
| Messages by level | Lines over time, split by level, so a burst of errors stands out from ordinary traffic. |
| Errors and warnings by device | Which routers send lines at the warning level or worse, next to All lines by device. |
| Latest errors and warnings | The lines themselves. |
| Failed sign-ins | Every failed sign-in, with the user, the address and the way they connected as RouterOS logged it. |
| Sign-ins | Sign-ins over SSH, Winbox, the web interface and the like. Sign-ins over the API are left out: they are automation, the manager itself among them. |
| Configuration changed by a person | Changes with who made them and the command. Changes made by the scheduler or a script are left out, and so are Wi-Fi clients disconnected with "removed by user". |
| Links going down | Every link down line. |
| All lines | Everything, newest first. |
It opens on the last 24 hours. Each widget's search is in its own settings and can be changed there.
How a line looks in Graylog
The router's name is in source. The message field holds the line as the router logged it, with the router's name in front and then the topics, for example:
core-01 system,info,account user admin logged in from 192.0.2.7 via sshlevel is the syslog severity the manager read from the topics, from 0 (emergency) to 7 (debug). facility is always user-level, because RouterOS does not send one.
The topics, the user and the address are not separate fields, so you find them by searching the message: source:core-01 AND message:account lists one router's sign-ins and sign-outs.
Limits
- Forwarding does not queue. Lines sent while Graylog is down or unreachable do not reach it later.
- The widgets find sign-ins and changes by the words in the line. A line RouterOS words differently in a future version may be missed until the search is updated.
- A line from an address the manager has no device for carries that address instead of a name.