How can I received logs from Mikrotik router

Hello,

I am having a problem about sending logs from Mikrotik to Graylog server hoping to help people, Thank you.

This is my config in Mikrotik to remote:

image

And everything I want to get for Graylog

image

I have tried 2 different configuration ways

  1. I use rsyslog as an intermediary
    My rsyslog config:

    #/etc/rsyslog.conf
    $ModLoad imudp
    $UDPServerAddress 45.122.222.180 ### Server Graylog + Rsyslog
    $UDPServerRun 514
    $AllowedSender UDP, 45.0.0.0/25 172.16.5.0/24

    $template Router1Log, “/var/log/mikrotik.log”
    :fromhost-ip, isequal, “172.16.5.253” -?Router1Log
    & stop

And I use UDP to send this to Graylog. I have created some messages for testing but it seems Graylog doesn’t receive my Mikrotik messages (only get syslog from my server).

  1. I sent straight from Mikrotik to Graylog but it doesn’t seem to work very well
    My router mikrotik config:

image

image

Any idea can be tried by me :((

From your screenshots, when you’re sending directly from the Mikrotik device to graylog, you are sending to port 5140 however, your screenshot of the Input shows that it is listening on Port 1514.

hmm… sorry about this but I have reconfig it but it still not working

image

Firewall in the way? If you run tcpdump on your graylog server, can you see the packets being received?

I dont use tcpdump, I have just configured an external firewall for the ports I use {514,1514,5514}.

Check built-in linux firewall on graylog server. Configuring input not necessarily opens these ports in linux firewall.

I ran Graylog server on centOS 7, I tried turning off firewalld, trying to send another message from Mikrotik and. … it still doesn’t work.

Can you send in messages from another source?

Yes, it seems Graylog cannot receive any messages from Mikrotik and I tried searching for forums and community about it but still couldn’t fix this