routeros-scripts/log-forward

#!rsc by RouterOS
# RouterOS script: log-forward
# Copyright (c) 2020 Christian Hesse <mail@eworm.de>
# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
#
# forward log messages via notification
# https://git.eworm.de/cgit/routeros-scripts/about/doc/log-forward.md

:global Identity;
:global LogForwardFilter;
:global LogForwardFilterMessage;
:global LogForwardLast;
:global LogForwardRateLimit;

:global IfThenElse;
:global LogPrintExit;
:global MailServerIsUp;
:global ScriptLock;
:global SendNotification;
:global SymbolForNotification;
:global WaitFullyConnected;

$ScriptLock "log-forward";

:if ([ :typeof $LogForwardRateLimit ] = "nothing") do={
  :set LogForwardRateLimit 0;
}

:if ($LogForwardRateLimit > 30) do={
  :set LogForwardRateLimit ($LogForwardRateLimit - 1);
  $LogPrintExit info ("Rate limit in action, not forwarding logs!") true;
}

$WaitFullyConnected;

:if ([ $MailServerIsUp ] = false) do={
  $LogPrintExit warning ("Mail server is not up.") true;
}

:local Count 0;
:local Messages "";
:local MessageVal;

:foreach Message in=[ / log find where !(topics~$LogForwardFilter) !(message~$LogForwardFilterMessage) ] do={
  :set MessageVal [ / log get $Message ];

  :if ($LogForwardLast = ($MessageVal->".id")) do={
    :set Messages "";
    :set Count 0;
  } else={
    :set Messages ($Messages . "\n" . $MessageVal->"time" . " " . \
      [ :tostr ($MessageVal->"topics") ] . " " . $MessageVal->"message");
    :set Count ($Count + 1);
  }
}

:if ($Count > 0) do={
  $SendNotification ([ $SymbolForNotification "warning-sign" ] . "Log Forwarding") \
    ("The log on " . $Identity . " contains " . [ $IfThenElse ($Count = 1) \
    "this message" ("these " . $Count . " messages") ] . " after " . \
    [ / system resource get uptime ] . " uptime.\n" . $Messages);

  :set LogForwardRateLimit ($LogForwardRateLimit + 10);
  :set LogForwardLast ($MessageVal->".id");
} else={
  :if ($LogForwardRateLimit > 0) do={
    :set LogForwardRateLimit ($LogForwardRateLimit - 1);
  }
}