Today I learned how the logging on Mikrotik RouterOS really works. Sadly, this isn’t mentioned in the Mikrotik docs. In many examples, it looks like you just add all the topics you like to receive. So you end up with something like this:
/system/logging
add action=remote disabled=no prefix="" topics=interface,route,ssh,stp,system,dns,event,firewall,manager,radvd,timer,vrrp,watchdog
But this wouldn’t work, and you won’t see any logs of the topics at all. This is because, with the line above, you need a log message to be tagged with all these topics, which is not going to happen because they are from very distinct parts of the system.
The topics you define on a config line are combined by a logical and. So if you want to follow all the topics above, you need to add them as standalone lines. But you can also filter them, for example, all interface messages but only error messages. Or DNS logs, but not packet logs.
Here are a few examples:
/system/logging
add action=remote topics=interface # logs everything with the topic/label interface
add action=remote topics=interface, debug # logs only debug messages for the topic interface
add action=remote topics=interface,!debug # logs everything but debug messages for the topic interface