diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
index a57de3199..fe7d2920c 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@@ -131,7 +131,7 @@ if (has_singbox or has_xray) and #nodes_table > 0 then
 			end
 			type.cfgvalue = get_cfgvalue(v.id, "type")
 			type.write = get_write(v.id, "type")
-			
+
 			-- pre-proxy
 			o = s:taboption("Main", Flag, vid .. "-preproxy_enabled", translate("Preproxy"))
 			o:depends("tcp_node", v.id)
@@ -507,13 +507,15 @@ trojan_loglevel:value("4", "fatal")
 
 o = s:taboption("log", Flag, "advanced_log_feature", translate("Advanced log feature"), translate("For professionals only."))
 o.default = "0"
-o.rmempty = false
-local syslog = s:taboption("log", Flag, "sys_log", translate("Logging to system log"), translate("Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."))
-syslog:depends("advanced_log_feature", "1")
-syslog.default = "0"
-syslog.rmempty = false
-local logpath = s:taboption("log", Value, "persist_log_path", translate("Persist log file directory"), translate("The path to the directory used to store persist log files, the \"/\" at the end can be omitted. Leave it blank to disable this feature."))
-logpath:depends({ ["advanced_log_feature"] = 1, ["sys_log"] = 0 })
+o = s:taboption("log", Flag, "sys_log", translate("Logging to system log"), translate("Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."))
+o:depends("advanced_log_feature", "1")
+o.default = "0"
+o = s:taboption("log", Value, "persist_log_path", translate("Persist log file directory"), translate("The path to the directory used to store persist log files, the \"/\" at the end can be omitted. Leave it blank to disable this feature."))
+o:depends({ ["advanced_log_feature"] = 1, ["sys_log"] = 0 })
+o = s:taboption("log", Value, "log_event_filter", translate("Log Event Filter"), translate("Support regular expression."))
+o:depends("advanced_log_feature", "1")
+o = s:taboption("log", Value, "log_event_cmd", translate("Shell Command"), translate("Shell command to execute, replace log content with %s."))
+o:depends("advanced_log_feature", "1")
 
 s:tab("faq", "FAQ")
 
diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po
index f4ff64d74..17c86ccda 100644
--- a/luci-app-passwall/po/zh-cn/passwall.po
+++ b/luci-app-passwall/po/zh-cn/passwall.po
@@ -1393,6 +1393,18 @@ msgstr "记录到系统日志"
 msgid "Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."
 msgstr "将日志记录到系统日志，以实现更加高级的功能。例如，把日志发送到专门的日志服务器。"
 
+msgid "Log Event Filter"
+msgstr "日志事件过滤器"
+
+msgid "Support regular expression."
+msgstr "支持正则表达式。"
+
+msgid "Shell Command"
+msgstr "Shell 命令"
+
+msgid "Shell command to execute, replace log content with %s."
+msgstr "要执行的 Shell 命令，用 %s 代替日志内容。"
+
 msgid "Not enabled log"
 msgstr "未启用日志"
 
diff --git a/luci-app-passwall/root/usr/share/passwall/socks_auto_switch.sh b/luci-app-passwall/root/usr/share/passwall/socks_auto_switch.sh
index 1c8d5905f..a43f895a8 100755
--- a/luci-app-passwall/root/usr/share/passwall/socks_auto_switch.sh
+++ b/luci-app-passwall/root/usr/share/passwall/socks_auto_switch.sh
@@ -3,13 +3,17 @@
 CONFIG=passwall
 LOG_FILE=/tmp/log/$CONFIG.log
 LOCK_FILE_DIR=/tmp/lock
-
+LOG_EVENT_FILTER=
+LOG_EVENT_CMD=
 flag=0
 
 echolog() {
 	local d="$(date "+%Y-%m-%d %H:%M:%S")"
-	#echo -e "$d: $1"
-	echo -e "$d: $1" >> $LOG_FILE
+	local c="$1"
+	echo -e "$d: $c" >> $LOG_FILE
+	[ -n "$LOG_EVENT_CMD" ] && [ -n "$(echo -n $c |grep -E "$LOG_EVENT_FILTER")" ] && {
+		$(echo -n $LOG_EVENT_CMD |sed "s/%s/$c/g")
+	}
 }
 
 config_n_get() {
@@ -86,7 +90,7 @@ test_auto_switch() {
 			return 1
 		fi
 	}
-	
+
 	[ $flag -le 1 ] && {
 		main_node=$now_node
 	}
@@ -96,7 +100,7 @@ test_auto_switch() {
 		echolog "自动切换检测：无法连接到网络，请检查网络是否正常！"
 		return 2
 	fi
-	
+
 	#检测主节点是否能使用
 	if [ "$restore_switch" == "1" ] && [ "$main_node" != "nil" ] && [ "$now_node" != "$main_node" ]; then
 		test_node ${main_node}
@@ -110,7 +114,7 @@ test_auto_switch() {
 			return 0
 		}
 	fi
-	
+
 	if [ "$status" == 0 ]; then
 		#echolog "自动切换检测：${id}【$(config_n_get $now_node type)：[$(config_n_get $now_node remarks)]】正常。"
 		return 0
@@ -154,6 +158,8 @@ test_auto_switch() {
 start() {
 	id=$1
 	LOCK_FILE=${LOCK_FILE_DIR}/${CONFIG}_socks_auto_switch_${id}.lock
+	LOG_EVENT_FILTER=$(uci -q get "${CONFIG}.global[0].log_event_filter" 2>/dev/null)
+	LOG_EVENT_CMD=$(uci -q get "${CONFIG}.global[0].log_event_cmd" 2>/dev/null)
 	main_node=$(config_n_get $id node nil)
 	socks_port=$(config_n_get $id port 0)
 	delay=$(config_n_get $id autoswitch_testing_time 30)