ModSyslogUI v1.1.0 [28-Feb-2026] - add-on providing System Log page UI filtering capabilities

[kstamand]

Updated 28-Feb-2026.
Be sure to run UPDATE option from the Shell's script menu, to get the latest release!!

v1.1. (28-Feb-2026)
- Added: UI - Filter presets (Save, Edit, Delete)
- Added: UI - inline filter validation
- Added: UI - dynamic help information
- Updated: UI - expanded filter logic capabilities beyond simple AND, OR, AND NOT to now include tag: term OPERATOR term
- Fixed: Script - invalid menu option handling (return to menu, and not exit), to show the latest version info in menu after update
- Added: Script - added capturing debugging to file when running Shell menus functions (for helping me troubleshoot)
- Updated: README - updated with Preset filtering information and added MIT License info

Source Code Change Log

ModSyslogUI - Customize router's "System Log" page with custom filtering capabilities​

About:​

The default filtering capabilities of what is displayed on the System Log page of the router is limited to hardcoded set of text strings in a file called "logFilter.json". This script adds a capability to edit that file to your likings.

This script also updates the System Log page of the Router UI to include dynamic filtering capabilities to:
Note - the script only filters records from the systems syslog file for display purposes, no records are deleted from the underlying syslog
Note - filtered text is case sensitive. So filtering for get is different than Get

• Show All - display all log records, excluding whatever is noted in logFilter.json (Show All is the default filer on page load, unless you have a Preset favorite of your choosing)
• Include - display only log records containing one of the string or strings of text you choose (separate each by a comma)
  Example - to include all Skynet and Diversion log records only, enter Skynet,Diversion
• Exclude - exclude log records containing any one of the string or strings of text you chose (separate each by a comma)
  Example - to exlcude all Firewall log records that where blocked, enter the string BLOCKED
• Logical - display only log records that match your logical conditions - term LOGICAL term (only AND | OR | AND NOT are valid LOGICAl options and must be upper case)
  
  Two types of logicals are supported - simple and "tags" (syslog record format - Date tag messages)​
  Simple - show only kernel errors, enter kernel AND error​
  Tags- show only kernel tagged records, where ethernet port is down (kernel: eth AND Down)​
• Presets - Save, Edit, or Delete your favorite filtering options - with the added capability of selecting one to load and run automatically when entering the System log page

This script only runs on Asuswrt-Merlin supported routers with firmware versions 3004.388.* and 3006.102.*

This script DOES NOT equal or replace the functionality that the SCRIBE addon provides.
Instead, it is a simpler lightweight addon that only utilizes the native capabilities of the router.

IT IS NOT RECOMMENDED TO INSTALL THIS SCRIPT AND SCRIBE AT THE SAME TIME. CHOOSE ONE OR THE OTHER

Overview:​

• Installs script onto router to add filtering capabilities to the routers "System Log" UI page
• The script provides an interactive manu of options to perform various script maintenance functions

Custom System Log filtering capabilities added with this script include:
1. Hardcoded Filtering - By default, the System Log page filters log records to display based on the contents of a "logFilter.json" file. This script includes an EDIT option that allows you to customize to your liking.
2. Dynamic Filtering - The System Log page is modifed to allow you to interactively select which log records to INCLUDE or EXCLUDE, with the default action of filtering records based on the contents of the logFilter.json file

Hardcoded Filtering changes are made from an SSH session to the router, and choosing option 5 from the modsyslogui menu

Install:​

Requires Asuswrt-Merlin and JFFS enabled

SSH to the router and enter:

/usr/sbin/curl --retry 3 "https://raw.githubusercontent.com/kstamand/modsyslogui/master/modsyslogui" -o "/tmp/modsyslogui" && chmod +x /tmp/modsyslogui && sh /tmp/modsyslogui install

Configuration:​

No configuration is required, unless you want to edit the default contents of the "logFilter.json" file --> option 5 from the modsyslogui menu.

The default contents of the logFilter.json file are:

      {
         "filter": [
         "already exist in UDB, can't add it",
         "not mesh client, can't update it's ip",
         "not exist in UDB, can't update it",
         "send_redir_page"
         ]
      }

To edit this file, add one line for each string from a given log record you want to exclude assocated log records from being displayed
- string needs to be enclosed in quotes ("")
- each line, except the last line of the list of filtering strings, must end in a comma (,)

Example custimized logFilter.json file, to exclude all wireless events ("wlceventd"), Diversion records ("Diversion:"), and Skynet BLOCKED records ("BLOCKED"):

        {
        "filter": [
           "already exist in UDB, can't add it",
           "not mesh client, can't update it's ip",
           "not exist in UDB, can't update it",
           "send_redir_page",
           "wlceventd",
           "Diversion:",
           "BLOCKED"
           ]
        }

TIPS
ALL System log records, generally start with a script function name. Examples;

• The majority of ADDON script contributors prefix their log records with the name of their script (e.g., Diversion, Skynet, Scribe, ...)
• Other than that, scan log records for unique strings from a given record to inlude / exclude, such as
  - wireless events (leaving or joining) = wlcevented
  - ethernet connected devices powering on or shutting down (entering listening | learning | forwarding state)
  - specific addon scripts (e.g., log records starting with modsyslogui)

Command line usage:​

Once installed, from a terminal ssh session into the router, enter the command modsyslogui and choose from one of the menu options:

To skip displaying the menu, you can run select options directly by running modsyslogui with one of the following parameters;
- modsyslogui install
- modsyslogui update
- modsyslogui enable
- modsyslogui disable
- modsyslogui uninstall

System Log Page usage:​

The System Log page is customized by this script to add a dynamic **Log Filtering Option** box, where you have three button options + a filtering text box (terms to be filtered on):
1. Show all log records - leave filter text box empty (this is the default option, unless you have a favorite preset you've set to be the default (Load automatically)
2. Include - display any records that match one of your filtering terms
3. Exclude - exclude records containing any one of your filtering terms from displaying
4. Logical - display any records that match your simple (term LOGICAL term) or tag selection (tag: term LOGICAL term) Complex boolean type functionality is not supported
5. Presets - save, edit, delete any of your favorite filtering options

License​

License​

Copyright (c) 2026 kstamand

This project is licensed under the MIT License.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, provided that the above copyright notice and this permission notice are included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

 

[thelonelycoder]

Finally a new script that is already amtm compatible during beta. And it looks to be useful.
Just remember @kstamand , when logging is enabled in Diversion, the Dnsmasq output goes to /opt/var/log/dnsmasq.log, not the SysLog.

 

[dineshgyl]

Does it just filter the data in UI or also prevent the records being actually written to /jffs/syslog.log?

 

[kstamand]

Does it just filter the data in UI or also prevent the records being actually written to /jffs/syslog.log?

It only filters log records from displaying in the UI, no filtering or changes are applied to syslog.log itself.

Let me know if you have any other questions or if you have any suggestion on updated wording to use in the original posting of this thread to make this clearer

 

[jksmurf]

it is a simpler lightweight addon that only utilizes the native capabilities of the router.

Really like the concept here. Thank you!

Initially I though it wasn't working, but it just needed a moment.
Could it eventually support Boolean uppercase delimiters e.g. Error AND Get (I tried it but it did not seem to.. yet ).

 

[kstamand]

Really like the concept here. Thank you!

Initially I though it wasn't working, but it just needed a moment.
Could it eventually support Boolean uppercase delimiters e.g. Error AND Get (I tried it but it did not seem to.. yet ).

View attachment 69786

Glad to hear you find it useful.

Regarding adding boolean capabilities, most definitely. First I'd like to get through the beta and see if there are any other feature requests / bugs to clean up.

Thanks for the feedback!!

 

[ColinTaylor]

@kstamand Just an academic question; Is it possible to remove the dependency on Entware and a USB drive? In other words have it run entirely standalone from /jffs.

 

[kstamand]

@kstamand Just an academic question; Is it possible to remove the dependency on Entware and a USB drive? In other words have it run entirely standalone from /jffs.

Hmmm. I hadn't thought about that ... do you happen to know if would that prevent the script from being added to AMTM, if it gains enough interest or is that a question for @thelonelycoder?

 

[ColinTaylor]

I don't see why that would exclude it from amtm. amtm itself runs entirely from jffs as did some of the third party addons in the past, e.g. Skynet.

I'm guessing that your code isn't constantly writing to storage while it's working?

Like I said, it's only an academic question for me. But as a general principle I try to avoid introducing any unnecessary dependencies if possible.

 

[thelonelycoder]

Hmmm. I hadn't thought about that ... do you happen to know if would that prevent the script from being added to AMTM, if it gains enough interest or is that a question for @thelonelycoder?

Let me put your mind to rest, I have your script on radar.

 

[ExtremeFiretop]

Hmmm. I hadn't thought about that ... do you happen to know if would that prevent the script from being added to AMTM, if it gains enough interest or is that a question for @thelonelycoder?

MerlinAU as an example does not require USB or Entware and is apart of AMTM. Along with others.

Entware and USB dependencies is usually only if the script requires it but would not impact integration with AMTM.

 

[kstamand]

Seeking assistance in trying to add Boolean logic support as @jksmurf asked in post #5 above.

- Can boolean search criteria (e.g., Get AND error) entered in a form input field be used "as-is" (meaning without any parsing/reconstruction) in a javascript .find or .includes method to filter the log records? If yes, can anyone point me to a working example?

- If the form input field can't be used 'as-is", is there another approach I can use other than using the split(" ") method into unique fields (e.g., string1, boolean_operator, string2), followed by some if then logic on the boolean_operator to build the appropriate .find or .includes method to filter the log records? If yes, kindly point me to some working examples for reference?

Thanks in advance

 

[Martinski]

Seeking assistance in trying to add Boolean logic support as @jksmurf asked in post #5 above.

- Can boolean search criteria (e.g., Get AND error) entered in a form input field be used "as-is" (meaning without any parsing/reconstruction) in a javascript .find or .includes method to filter the log records? If yes, can anyone point me to a working example?

- If the form input field can't be used 'as-is", is there another approach I can use other than using the split(" ") method into unique fields (e.g., string1, boolean_operator, string2), followed by some if then logic on the boolean_operator to build the appropriate .find or .includes method to filter the log records? If yes, kindly point me to some working examples for reference?

Thanks in advance

My initial suggestion would be to first clearly define the syntax that the input field will accept as valid entries.

1) Define the keywords to be used as valid boolean operators.

Examples: all upper cases OR, AND, NOT (??).​

2) Define the basic syntax of the boolean expressions that the input field will accept as valid.

Examples:​

"string01" OR "string02"​

"string01" AND "string02"​

"string01" AND NOT "string02"​

3) Define if the input field will accept compound boolean expressions.

Examples:​

"string01" OR "string02" OR "string03" OR "string04"​

"string01" AND "string02" AND "string03" AND "string04"​

"string01" AND "string02" AND "string03" AND NOT "string04"​

("string01" AND "string02") OR ("string03" AND "string04")​

Once you have settled on the valid syntax and grammar rules, those will dictate how you implement the code.

But in any case, accepting the input field "as is" "(meaning without any parsing/reconstruction)" is not really feasible or recommended because you will always need to parse the input strings anyway; first, just to check they contain a valid syntax for a boolean expression; and second, to "sanitize" the string values before feeding them to the appropriate JavaScript functions that will perform the logical operations.

Just my 2 cents.

 

[kstamand]

@Martinski thanks for the feedback. That is the path I am on already, but figured I'd ask the community before I go too far down that path.

Thanks again

 

[kstamand]

@jksmurf - I've added basic logical expression filtering capabilities (AND or OR or AND NOT). Uninstall, then reinstall modsyslogui and give it a shot. Hopefully that meets your needs.

Really like the concept here. Thank you!

Initially I though it wasn't working, but it just needed a moment.
Could it eventually support Boolean uppercase delimiters e.g. Error AND Get (I tried it but it did not seem to.. yet ).

View attachment 69786

 

[kstamand]

@kstamand Just an academic question; Is it possible to remove the dependency on Entware and a USB drive? In other words have it run entirely standalone from /jffs.

@ColinTaylor I realize your question was just academic, but I believe the code is not dependent on Entware and a USB.

Unless I'm overlooking something in my code, the only portion of code that may be related is where I'm adding an alias for modsyslogui ==> that section checks if the /opt/bin directory exists (which I believe only exists if entware is installed which requires a USB) and if not, it then adds the alias to profile.add instead. The intent was to be able to add an alias whether entware was or wasn't installed.

Was there a dependency somewhere else in the code I'm overlooking?

 

[jksmurf]

@jksmurf - I've added basic logical expression filtering capabilities (AND or OR or AND NOT). Uninstall, then reinstall modsyslogui and give it a shot. Hopefully that meets your needs.

Thank you for looking into this.

1. Uninstall worked fine, reinstall only with the complete curl line, is that expected ?

2. Minor type in text box?

3. But are you saying it will not work with TWO words with AND or OR, ONLY 3-4?

4. Tried 3 words but couldn’t not seem to get it to work ?

Sorry if I’m not doing something correctly here?

 

[jksmurf]

FYI

Just playing with updates. If it’s up to date, might not need to proceed with updates?

 

[ColinTaylor]

@jksmurf I don't see a typo myself and the meaning appears clear.
EDIT: Do you mean the capital C in the "blah blah blah Contains" error message?

In your case the line you're entering is invalid. You could use:

hostap AND wl0.1

or

hostap AND NOT wl0.1

Note that it's wl not w1.

 

[jksmurf]

@jksmurf I don't see a typo myself and the meaning appears clear.

Sorry, was just a space before the word “Contains”, so assumed a typo of some kind that makes it do that, or formatting. I’m not a coder by any stretch, so I’m just reporting what I see in the text boxes that come up.

In your case the line you're entering is invalid. You could use:

hostap AND wl0.1

or

hostap AND NOT wl0.1

Note that it's wl not w1.

Doh. That’ll teach me. I’m on an iPad propped up in bed.

But if it’s mistyped then surely it’s a null result, which is not what I got?
And what logical operators am I using that are incorrect. See error messages in the white boxes.
I’m not actually searching for anything I’m just testing, as requested, but even when I correct it I’m getting the messages, but not the correct filter?

If I’m inputting things incorrectly here I’m happy to be pointed in the right direction, especially if my trials work for others without the messages.