User Manager/Logs

Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received.

It is configurable per router which logs must be written (See: HOWTO).

Log data contains:

• Username. Can differ from those registered in user table;
• User IP;
• Host IP. Router's IP;
• Status;
• Time;
• Description;
• NAS Port;
• NAS Port type;
• NAS Post ID;
• ACCT Session ID;
• Calling station ID.

More information on what these fields mean can be found in Mikrotik RouterOS Radius client documentation, Supported RADIUS Attributes.

Sending logs to Syslog

Starting from version 3.24, support for sending logs to SysLog is added. To enable it:

1) Configure per router, which requests to log: accounting/authorization failure/success (See: HOWTO);

2) On the router configure log writing:

/system logging add topics=manager,account action=remote
/system logging action set remote target=remote remote=1.2.3.4:514

, where 1.2.3.4 and 514 is IP address and UDP port of the remote host, which will receive the logs.

3) Configure your remote host to listen on port 514 (any other port can be used, but it MUSt be UDP port and MUST match the one entered in router's system logging action);