Diagnostics, Monitoring and Troubleshooting

Diagnostics, Monitoring and Troubleshooting

RouterOS provides a comprehensive suite of diagnostic and monitoring tools to help network administrators identify issues, analyze traffic, and maintain optimal router performance. This guide covers all major diagnostic tools available in RouterOS.

Overview

MikroTik routers include built-in tools for:

• System resource monitoring
• Hardware health monitoring
• Network connectivity testing
• Traffic analysis and packet capture
• Network discovery

System Resource Monitoring

The Resource menu displays overall system statistics including uptime, memory usage, disk space, and CPU information.

Viewing Resource Information

/system resource print

Example output:

                   uptime: 29s
                  version: 7.11.2 (stable)
               build-time: Aug/31/2023 13:55:47
         factory-software: 7.6
              free-memory: 94.2MiB
             total-memory: 224.0MiB
                      cpu: ARM
                cpu-count: 2
            cpu-frequency: 800MHz
                 cpu-load: 2%
           free-hdd-space: 93.5MiB
          total-hdd-space: 128.5MiB
         write-sect-since-reboot: 85
               bad-blocks: 0%
        architecture-name: arm
               board-name: hAP ax lite LTE6
                 platform: MikroTik

Resource Properties

Property	Description
uptime	Time elapsed since last boot
version	Installed RouterOS version
cpu	CPU model
cpu-count	Number of CPU cores
cpu-load	Current CPU utilization percentage
free-memory	Available RAM
total-memory	Total installed RAM
free-hdd-space	Available NAND/SSD storage
total-hdd-space	Total storage capacity
bad-blocks	Percentage of defective NAND blocks

Per-CPU Monitoring

View individual CPU core usage on multi-core systems:

/system resource cpu print

Output:

CPU LOAD IRQ DISK
0 5% 0% 0%
1 3% 0% 0%

IRQ Monitoring

View interrupt request (IRQ) distribution:

/system resource irq print

This helps identify hardware conflicts or overloaded interrupt handlers.

PCI Device Information

View all PCI devices installed in the router:

/system resource pci print

USB Device Information

View connected USB devices:

/system resource usb print

Hardware Health Monitoring

The Health menu displays real-time hardware sensor data including temperature, voltage, fan speed, and power consumption.

Note

Hardware health monitoring availability varies by device. Check your router’s specifications at mikrotik.com.

Viewing Health Information

/system health print

Example output on CCR1072-1G-8S+:

Columns: NAME, VALUE, TYPE
 #  NAME                VALUE  TYPE
 0  power-consumption   50.8   W
 1  cpu-temperature     43     C
 2  fan1-speed          5654   RPM
 3  fan3-speed          5800   RPM
 4  board-temperature1  29     C
 5  psu1-voltage        0      V
 6  psu2-voltage        12.1   V

Temperature Monitoring

Routers with temperature sensors display:

• cpu-temperature: Processor temperature
• pcb-temperature: Printed circuit board temperature
• sfp-temperature: SFP module temperature

Caution

Device “tested ambient temperature range” in product specifications refers to the environmental conditions for the device’s physical location, NOT the temperatures reported by health monitoring. Always consult hardware specifications for operating temperature limits.

Voltage Monitoring

View input voltage and power supply status:

Columns: NAME, VALUE, TYPE
#  NAME         VALUE  TYPE
0  voltage      23.8   V
1  temperature  39     C

Note

Routers with both PoE and barrel jack power input use PEXT for calibration. Voltage readings over PoE may appear lower due to ethernet protection circuitry.

Fan Control Configuration

For devices with configurable fans:

/system health set fan-target-temp=55 fan-min-speed-percent=10

Property	Description
fan-target-temp	Target temperature for fan speed adjustment (default: 58°C)
fan-full-speed-temp	Temperature triggering maximum fan speed (default: 65°C)
fan-min-speed-percent	Minimum fan speed percentage
fan-control-interval	Temperature reading interval in seconds (5-30)
cpu-overtemp-check	Enable CPU overtemperature protection (ARM devices)
cpu-overtemp-threshold	Maximum temperature before shutdown

Caution

The fan-control-interval setting directly affects CPU usage. Lower intervals provide faster response but increase CPU load.

Fan Speed Behavior

Fan speed automatically adjusts based on:

PoE-out Load	Fan Speed
0-24%	0% (off)
25-46%	25%
47-70%	50%
71-92%	75%
93%+	100%

Ping

The Ping tool uses ICMP Echo messages to test network connectivity and measure round-trip delay between the router and target hosts.

See Ping for comprehensive documentation covering:

• Basic and advanced ping parameters
• MAC ping, multicast ping, and broadcast ping
• Troubleshooting techniques and result interpretation
• Script integration and automation

Traceroute

Traceroute displays the path packets take to reach a destination, helping identify where network delays or failures occur.

Basic Usage

/tool traceroute 10.0.0.1

Output:

     ADDRESS                  STATUS
   1       10.0.1.17 2ms 1ms 1ms
   2    10.255.255.1 5ms 1ms 1ms

How Traceroute Works

Traceroute exploits the TTL (Time-To-Live) field in IP packets:

1. First packet sent with TTL=1 - first router replies with ICMP Time Exceeded
2. Second packet with TTL=2 - second router replies
3. Continues incrementing until destination reached

This reveals each hop in the path and response times.

Traceroute Options

Parameter	Description
address	Target destination
max-hops	Maximum number of hops (default: 30)
timeout	Wait time for responses
count	Probes per hop

Interpreting Results

• High latency at a specific hop: That router or link is congested
• Request timeout: Packet loss or firewall blocking ICMP
• ** asterisks (*)**: No response received

Torch

Torch is a real-time traffic monitoring tool that displays active traffic flows through an interface.

Running Torch

/tool torch interface=ether1

Traffic Classification

Torch can monitor traffic by:

• Source/destination IP address (IPv4 and IPv6)
• Port numbers
• Protocol (TCP, UDP, ICMP, etc.)
• MAC protocol
• VLAN ID
• DSCP

Torch Options

Parameter	Description
interface	Interface to monitor
address	Filter by IP address
port	Filter by port
protocol	Filter by protocol
src-address	Filter by source IP
dst-address	Filter by destination IP

Caution

Torch shows traffic BEFORE firewall filtering. You may see packets that would be dropped by firewall rules.

Limitations

• Unicast traffic between wireless clients with client-to-client forwarding enabled is not visible
• Traffic processed with hardware offloading on bridges may not appear

Packet Sniffer

The packet sniffer captures network packets for detailed analysis, useful for troubleshooting and security auditing.

Basic Sniffing

/tool sniffer start interface=ether1
/tool sniffer stop
/tool sniffer save file-name=capture.pcap

The captured file can be analyzed with Wireshark.

Quick Mode

For immediate results without saving:

/tool sniffer quick ip-protocol=icmp

Filtering Options

The sniffer supports extensive filtering:

Filter	Description
filter-ip-address	Filter by IP address
filter-src-ip-address	Filter by source IP
filter-dst-ip-address	Filter by destination IP
filter-port	Filter by port
filter-src-port	Filter by source port
filter-dst-port	Filter by destination port
filter-ip-protocol	Filter by protocol (tcp, udp, icmp, etc.)
filter-mac-address	Filter by MAC address
filter-vlan	Filter by VLAN ID
filter-direction	Filter by direction (rx, tx)

Configuration Properties

/tool sniffer set file-name=capture.pcap file-limit=5000KiB \
   filter-ip-protocol=tcp filter-dst-port=80,443

Property	Description
file-name	Save capture to file
file-limit	Maximum file size (10-4294967295 KiB)
memory-limit	Buffer size for captured packets
memory-scroll	Overwrite old data when buffer full
only-headers	Capture headers only, not payload
streaming-enabled	Stream to remote server

Viewing Sniffer Statistics

After capturing, view results:

/tool sniffer protocol print    # Protocol distribution
/tool sniffer host print        # Host statistics
/tool sniffer connection print # Active connections

Note

Captured packets are available for 10 minutes. Save to file immediately if permanent storage needed.

IP Scan

IP Scan discovers devices on your network, collecting IP addresses, MAC addresses, DNS names, and SNMP information.

See IP Scan for complete documentation.

Logging

RouterOS logging provides detailed system event records essential for troubleshooting.

Viewing Logs

/log print

Log Categories

/system logging add topics=info
/system logging add topics=error
/system logging add topics=warning
/system logging add topics=critical

Log Actions

Configure where logs are stored:

Action	Description
memory	RAM buffer (default)
disk	NAND/SD card storage
remote	Remote syslog server
echo	Display in terminal

Remote Syslog Configuration

Send logs to a remote server:

/system logging action set remote remote=192.168.1.100
/system logging add action=remote topics=info

Log Topics

Essential topics for troubleshooting:

/system logging add topics=firewall action=memory
/system logging add topics=interface action=memory
/system logging add topics=error action=memory
/system logging add topics=critical action=memory

Multiple Topics: AND vs OR Logic

When specifying multiple topics in a logging rule, the behavior depends on how topics are combined:

• Multiple topics in one rule (AND logic): When you specify topics=firewall,info, the rule matches only if BOTH conditions are true—the log entry must have both the firewall topic AND the info topic.

# Log entries that have BOTH 'firewall' AND 'info' topics
/system logging add topics=firewall,info action=memory

• Multiple rules (OR logic): When you have separate logging rules, a log entry matches if it matches ANY of the rules:

# Log entries that have 'firewall' topic OR 'error' topic
/system logging add topics=firewall action=memory
/system logging add topics=error action=memory

Practical Examples

# Log all firewall events (any severity)
/system logging add topics=firewall action=memory

# Log only critical firewall events (AND logic)
/system logging add topics=firewall,critical action=memory

# Log all critical events regardless of topic (separate rules = OR)
/system logging add topics=firewall action=memory
/system logging add topics=interface action=memory
/system logging add topics=critical action=memory

Tip

Use AND logic (comma-separated topics) to narrow down to specific event types. Use multiple separate rules when you want to capture different types of events with different actions.

Common Troubleshooting Scenarios

High CPU Usage

1. Check CPU usage by process: /system resource cpu print
2. Review IRQ distribution: /system resource irq print
3. Check for interface storms
4. Review firewall rules for excessive logging

High Memory Usage

1. Check memory with /system resource print
2. Review active connections
3. Check for routing table issues
4. Look for memory leaks in packages

Network Connectivity Issues

1. Verify interface status: /interface print
2. Test basic connectivity: /ping
3. Trace path: /tool traceroute
4. Check firewall rules: /ip firewall filter print
5. Review NAT rules: /ip firewall nat print

Interface Errors

1. Check interface statistics: /interface ethernet print
2. Look for CRC errors, frame errors
3. Verify cable and link status
4. Check speed/duplex settings

Temperature Issues

1. Monitor health: /system health print
2. Check fan operation
3. Verify environmental conditions
4. Review CPU/overtemp settings

Monitoring Best Practices

1. Regular monitoring: Check resource usage periodically
2. Set up logging: Enable appropriate log topics
3. Use profiles: Create threshold alerts for critical metrics
4. Baseline performance: Document normal values for comparison
5. Document issues: Keep records of problems and resolutions

Related Resources

• Official MikroTik Diagnostics Documentation
• RouterOS Resource Management
• Health Monitoring
• Wireshark - Packet analysis tool