MikroTik Daily Maintenance Checklist for Admins

MikroTik Daily Maintenance Checklist

Preventive maintenance separates networks that run for years without issues from those that fail at the worst possible moment. This checklist covers the key things to verify regularly on every MikroTik router you manage.

1. Check System Resources

/system resource print

Look for:

• CPU: sustained load above 80% is a warning sign (firewall rules, logging, or traffic flooding the CPU)
• Memory: RouterOS needs free memory; if free RAM drops below ~20 MB, investigate
• Uptime: note when the device last rebooted — unexpected reboots indicate power issues or crashes

2. Review Active Logs

/log print where severity=warning
/log print where severity=error
/log print where severity=critical

Look for recurring error messages, authentication failures, or interface errors. One error occasionally is fine; the same error every few minutes needs investigation.

3. Check Interface Status

/interface print
/interface ethernet print stats

Look for unexpected R (running=no) interfaces, or high error/drop counters which indicate physical layer problems (bad cable, duplex mismatch, or SFP issues).

4. Verify All Tunnels and WAN Connections

/interface pppoe-client print
/ip ipsec active-peers print
/interface wireguard peers print

Check that all VPN tunnels and WAN connections are active. Automated monitoring (Netwatch) should alert you if they drop, but a visual check is good habit.

5. Check DHCP Leases and Pool Exhaustion

/ip pool print
/ip dhcp-server lease print count-only

If your DHCP pool only has a handful of addresses left, you may be approaching exhaustion. Investigate stale leases or expand the pool before clients start failing to get IPs.

6. Review Firewall Connection Table

/ip firewall connection print count-only

A dramatically higher connection count than usual may indicate a scanning attack, malware on a client, or a DoS event. Normal counts vary by network size.

7. Check Queue Drops

/queue simple print stats

High packet drop percentages mean your bandwidth limits are actively throttling traffic — either expected (your policy is working) or unexpected (a new bandwidth consumer appeared).

8. Verify DNS Resolution

/resolve google.com

If this fails, DNS is broken — clients will experience "no internet" symptoms even though routing may be fine.

9. Confirm NTP Sync

/system ntp client print

Confirm the time is accurate. Log timestamps from a clock-drifted router are useless for security forensics.

10. Check Available Disk Space (for devices with storage)

/disk print
/file print

Old backup and export files accumulate. Purge backups older than 30-90 days.

Quick Health Summary Command

Combine multiple checks into one terminal session:

/system resource print
/interface print
/ip route print where active=yes
/ip firewall connection print count-only
/log print where severity=warning count-only

Running through this checklist takes under 5 minutes but catches 90% of problems before they become incidents. Build it into your weekly routine or, better yet, automate these checks with a monitoring system that alerts you proactively.