History and Safe mode

The history

All MikroTik RouterOS devices keep a history of user actions. The history is accessible through Winbox ⇢ System ⇢ History or through terminal/ssh using /system history print detailed. Note that Winbox shows the latest change at the bottom, while the terminal shows the latest at the top.

In the top left section of the Winbox interface you can use the arrow back to undo (go back) and the arrow forward to redo (go forward again, after going back). Using terminal you can type /undo or /redo.

In the history list, you will see an U at the left side if the action can be undone, and an R if it can be redone. If you can't see anything in the column in Winbox, try to increase the column width.

The history list is global for all users, so what one user changes can be undone and redone by other users. If one user undo some changes, they can only be redone, while no other changes have been made in the router. Say, if you undo 5 changes, and you yourself or another user then make another change, the undid changes are removed from the history list, and it will only show the older changes, and the new change that was done by you or another user.

Safe mode

To be safe when making changes - especially in the firewall - you should use the safe mode option. If you loose the connection to Winbox/ssh while in safe mode, it will remove all the changes you did, so if you made a mistake while editing the firewall and locked yourself out, the changes will be dropped and you will again have access.

Safe mode is also very convenient when you are making changes, you are not really sure will work. If something breaks, you can then quickly close the connection and all your changes will be dropped, and everything is back as it was.

While you are in safe mode, RouterOS adds "floating-undo" actions, marked with a "F" in the history. If you leave safe mode normally your changes are saved, and the F actions, will become U actions that can be undone. If you quit safe mode without saving, the F actions are removed.

In the terminal, you can enter safe mode with CTRL+X, and leave safe again with CTRL+X which saves your changes. If you want to leave safe mode and drop your changes, in the terminal you can press CTRL+D.

Note that there can at any time only be one user on the same device with safe on. If somebody else has safe mode on and you need to use it, you can use CTRL+X in the terminal, which will allow you to  take the safe mode session from the other user. You will be presented with 3 options:

u - Undo all safe mode changes made by the other user, and put the current session in safe mode.
r - Keep all safe mode changes made by the other user, and put the current session in safe mode. Also notifies previous owner.
d - Don't do anything, leave safe mode at the other user

If you happen to press CTRL+V you enter hot lock mode, which is shown in the console with command lines begginning with >>. In hotlock mode, the console will complete (auto-complete) your words even without pressing tab. You can disable hotlock again with CTRL+V.

Also note, that if you in Winbox use the New Terminal icon in the menu, to enter terminal commands, you are actually doing a local telnet login to the router. This means you can't release safe mode from the terminal if you have started safe mode with the Winbox button. But RouterOS still reverts changes both in Winbox and in your New terminal if you disconnect without leaving safe mode first. That is because disconnecting without closing safe mode, reverts all changes done by you or any other user, while you where in safe mode.

If you quit Winbox while in safe mode, Winbox will alert you that you need to stop safe mode before you quit, to save your changes. If you proceed, all your changes are dropped immediately. But if you loose the connection while using Winbox, RouterOS will per default wait 9 minutes before it drops your changes. This allows you to regain the connection, if you lost it due to bad internet connectivity and save your changes, that would otherwise be lost.

As a default the history stores the last 100 commands since last reboot. If you while you are in safe mode enter more than 100 commands, all the commands will be saved!

There is one case where safe mode will not save you. If the port you are connecting to the MikroTik to, is a slave port to another master port, and you set the port you connect to as "None", to create it as a new master, you will loose access and safe mode will not help you.