MikroTik / RouterOS · Tutorial · July 2026

MikroTik
Logging, SNMP & Traffic-Flow

A router you can't see into is a router you can't troubleshoot — and a breach you'll find out about from someone else. This is the RouterOS observability stack: correct time first, then remote syslog so logs survive a reboot, SNMPv3 for health, and Traffic-Flow to see what's actually crossing the wire. The Cisco observability post, in RouterOS.

MikroTik RouterOS Syslog SNMP NetFlow

Observability is four independent feeds, and they build on each other. NTP comes first because a log with the wrong timestamp is worse than no log — you can't correlate across devices without synchronised clocks. Remote syslog ships events off-box so they outlive a reboot or a wipe (RouterOS keeps logs in RAM by default — they vanish on restart). SNMPv3 exposes interface counters, CPU, and temperature to a monitoring system. Traffic-Flow (MikroTik's NetFlow/IPFIX export) tells you not just how much traffic but which conversations — the difference between "the link is full" and "the link is full because one host is seeding torrents."

Same four pillars as Cisco IOS: Observability (NTP, Syslog, SNMP, NetFlow), and they feed the same collectors — point RouterOS and IOS at one syslog server and one flow collector and the estate looks uniform.

Prerequisites

A collector host reachable on the management network (syslog + flow + SNMP poller)
The hardened input chain — expose these services to the mgmt subnet only

Time First — NTP

Do this before anything else. Every log, every certificate check, every scheduled script depends on the clock being right.

Terminal — sync the clock, set the zone

> /system ntp client set enabled=yes servers=time.google.com,gr.pool.ntp.org
> /system clock set time-zone-name=Europe/Athens
> /system ntp client print   # status: synchronized

Remote Syslog — Logs That Survive a Reboot

RouterOS logs to memory by default — a reboot erases them, and an attacker's first move is a reboot. Ship the important topics to a syslog server and they're beyond the router's reach.

Terminal — a remote action, then rules that use it

# Define WHERE logs go (your syslog collector):
> /system logging action add name=syslog target=remote remote=10.10.99.10 remote-port=514

# Send the topics that matter to it. Firewall + auth are the security ones.
> /system logging add topics=info action=syslog
> /system logging add topics=critical,error,warning action=syslog
> /system logging add topics=account action=syslog   # login events
# Tip: log dropped-input firewall hits by adding log=yes to the drop rule.

◆ Log the Logins

The account topic records who logged in, from where, and when — the single most useful security feed a router produces. Combined with the firewall's drop-rule logging, a remote syslog server gives you a tamper-resistant record of both "who touched the box" and "who tried to reach it." On a compromised router the local log is untrustworthy; the copy on the syslog server is the one you investigate with.

SNMPv3 — Health Without the v2c Risk

SNMP feeds your dashboards interface counters, CPU, memory, and temperature. Use v3 with authentication and privacy — v1/v2c community strings are the exact weakness the offensive posts exploit.

Terminal — an authPriv v3 user, bound to the poller

> /snmp community add name=noctis-v3 \
    security=private \
    authentication-protocol=SHA1 authentication-password="auth-pass-here" \
    encryption-protocol=AES encryption-password="priv-pass-here" \
    addresses=10.10.99.10/32
> /snmp set enabled=yes contact="noc@noctis" location="Core Rack" \
    trap-version=3

⚠ Gotcha — Don't Leave the Default public Community

Enabling SNMP leaves a default v1/v2c community named public in place. Anyone who can reach UDP 161 can then read your entire device — interface names, addresses, routes — no password. Disable or rename it, restrict SNMP to the poller's address (as above), and prefer v3 outright. This is the RouterOS version of the SNMP finding that shows up in every network pentest; the offensive walk is in Attacking MikroTik Gear.

Traffic-Flow — See the Conversations

Counters tell you a link is busy; flow export tells you who's making it busy. Traffic-Flow is MikroTik's NetFlow/IPFIX — enable it, point it at a collector, and every conversation becomes queryable.

Terminal — enable flow export to a collector

> /ip traffic-flow set enabled=yes interfaces=all \
    cache-entries=64k active-flow-timeout=1m
# Send to your NetFlow/IPFIX collector. version=9 or ipfix for v6/labels.
> /ip traffic-flow target add dst-address=10.10.99.10 port=2055 version=9
# Now "top talkers", per-host usage, and anomaly detection come from
# the collector, not guesswork. Great for spotting an infected host.

Takeaways

NTP first, always. A wrong clock makes every other log useless for correlation.
RouterOS logs to RAM — ship them off-box. Remote syslog is the only copy that survives a reboot or an attacker.
Log the account topic and firewall drops — who logged in and who was turned away are your highest-value security feeds.
SNMPv3 authPriv, bound to the poller. Kill the default public community — it's a free read of the whole device.
Traffic-Flow shows conversations, not just volume — the fast path from "link is full" to "this host is the reason."
Point RouterOS and IOS at the same collectors so a mixed estate reads as one system.

Network problems you only hear about from angry guests?

NOCTIS instruments MikroTik and Cisco networks across Crete with proper time, off-box logging, SNMP dashboards, and flow visibility — so you see the problem before the front desk does.

Book a Discovery Call →