The manager can receive syslog from your routers and keep it searchable in one place. This is what to switch on, on both ends.
The manager ships its own syslog listener — UDP and TCP, both on port 5514, both enabled by default. Messages are stored and streamed live to the Logs page as they arrive.
TCP is worth choosing when UDP is filtered somewhere in the path, or when you would rather have delivery than speed; RouterOS 7 supports both.
Nothing is collected until a router is told to send. The Logs page has a Setup Guide that generates the commands with your manager's own address already filled in, and can hand them over as a ready script — use it rather than retyping the shape below:
/system logging action add name=mgr target=remote remote=<MANAGER_IP> remote-port=5514
/system logging add topics=info action=mgr
/system logging add topics=warning action=mgr
/system logging add topics=error action=mgr
/system logging add topics=critical action=mgrFor TCP instead of UDP the action carries remote-protocol=tcp. Which topics you send is your decision — the four above are a reasonable default, and adding more means more volume to store.
Messages appear as they do in the device's own log. The receiver also accepts the RFC3164-style forms, so a device configured the BSD way still lands correctly.
Incoming messages are matched to a device by any of its interface addresses, collected on each poll — not only by the address you manage it on. That is why a router with several addresses does not need its source address pinned for logs to be attributed correctly.
If entries show up as unknown with a bare IP just after setup, the usual cause is that the manager has not polled that device since, so it does not yet know that address belongs to it. Waiting for a poll normally fixes it; pinning the source address on the logging action fixes it immediately.
Logs are pruned on two axes so that neither a long quiet period nor one very chatty device fills the database: by age, seven days by default, and by rows per device, ten thousand by default. Both are adjustable in Settings, and either can be overridden for a single device on its own form — useful when one router matters more, or talks far more, than the rest.
Scoped users see the logs of their own sites only, the same as everywhere else.
The log receiver is not only a viewer. Repeated failed logins seen in this stream are what the auto-block feature counts, aggregated per source address across the whole fleet — so switching on log collection is also what makes that feature possible. It is opt-in per device and has an audit-only mode; the Security page is where it lives.