List of all attributes that support scripting?

Amm0 · February 22, 2026, 1:10am

I'm working on adding a "Virtual Script File System" for my TikBook VSCode extension.

Currently wired up /system/script, but trying to fill in the rest of "script attributes", so they can be edited/saved directly in VSCode.

But there is no way to "find" all attributes that support RouterOS script, so I've come up with a list of what, I believe, are most of them. Various monitor do={} scripts are ignored since they are not saved tto config

Here is what I came up with & amended based on @xrills and @tdw comments.

Scripts persisted in `export`

- system
   - script/[name]...
        - source=
    - scheduler/[name]...
        - on-event=
    - routerboard
        - mode-button
            - on-event=
        - reset-button
            - on-event=
        - wps-button
            - on-event=
    - logging
      - action (_where_ type=script)[name]...
        - script=
- interface
    - vrrp/[name]...
        - on-master=
        - on-backup=
- ip
   - dhcp
      - client/[name]...
         - script=
       - server/[name]...
         - lease-script=
         - alert/[interface]...
            - on-alert=

- ipv6
   - dhcp-client/[name]...
      - script=
    - dhcp-server/[name]...
       - binding-script=
    - hotspot
        - user-profile/[name]...
            - on-login=
            - on-logout=
- tool
    - netwatch[name*]... (*use name= not empty... use host= if unqiue, otherwise concat .id with host like host-.id as a file name) 
        - on-up=
        - on-down=
        - on-test=
    - traffic-monitor/[name]...
        - on-event=
- ppp
    - profile/[name]...
        - on-up=
        - on-down=
- iot
    - mqtt
        - subscriptions[topic]...
            - on-message=
     - gpio
       - digital
          - script=

[attribute]... indicates multiple items, with the "unique friendly name" noted since I'm mapping into a file system

"Transitory Scripts"

My specific need is scripts that are stored in RouterOS export, so "persisted scripts". But there are "transitory scripts" that run as part of a command a CLI, and likely listen-able from native API. @infabo points out new print event script:

/log/print/follow on-event=
/log/print/follow-only on-event=

and a partial list of other transitory scripts:

/caps-man/interface/scan*
/certificate/create-certificate-request
/certificate/enable-ssl-certificate
/certificate/sign
/disk/blink
/disk/copy
/disk/format*
/disk/monitor-traffic
/disk/nvme-discover*
/disk/test*
/dude/export-db
/dude/import-db
/dude/vacuum-db
/file/sync/monitor
/interface/bonding/monitor
/interface/bonding/monitor-slaves*
/interface/bridge/monitor
/interface/bridge/mst-override/monitor
/interface/bridge/msti/monitor
/interface/bridge/port/monitor
/interface/ethernet/monitor
/interface/ethernet/cable-test/monitor
/interface/l2tp-client/monitor
/interface/l2tp-ether/monitor
/interface/l2tp-server/monitor
/interface/lte/cell-monitor*
/interface/lte/monitor
/interface/lte/monitor-traffic
/interface/lte/scan*
/interface/lte/esim/provision
/interface/lte/esim/firmware-upgrade
/interface/lte/esim/scan
/interface/mesh/traceroute*
/interface/monitor-traffic
/interface/ovpn-client/monitor
/interface/ovpn-client/import-ovpn-configuration
/interface/ovpn-server/monitor
/interface/ppp-client/info
/interface/ppp-client/monitor
/interface/ppp-client/firmware-upgrade
/interface/ppp-client/scan*
/interface/ppp-server/monitor
/interface/pppoe-client/monitor
/interface/pppoe-client/scan*
/interface/pppoe-server/monitor
/interface/pptp-client/monitor
/interface/pptp-server/monitor
/interface/sstp-client/monitor
/interface/sstp-server/monitor
/interface/vpls/monitor
/interface/wifi/monitor
/interface/wifi/devel*
/interface/wifi/flat-snoop*
/interface/wifi/frequency-scan*
/interface/wifi/scan*
/interface/wifi/sniffer*
/interface/wifi/spectral-history*
/interface/wifi/spectral-scan*
/interface/wifi/wps-client
/interface/wireless/align/monitor*
/interface/wireless/monitor
/interface/wireless/frequency-monitor*
/interface/wireless/nstream-dual/monitor
/interface/wireless/wds/monitor
/interface/wireless/scan*
/interface/wireless/setup-repeater
/interface/wireless/sniffer/sniff
/interface/wireless/snooper/flat-snoop*
/interface/wireless/snooper/snoop*
/interface/wireless/spectral-history*
/interface/wireless/spectral-scan*
/interface/wireless/wps/monitor
/interface/wireless/wps-client
/iot/modbus/read-holding-registers
/ip/dhcp-relay/monitor
/ip/dhcp-proxy/monitor
/ip/traffic-flow/monitor
/ip/route/check
/ip/proxy/monitor
/ipv6/dhcp-relay/monitor
/queue/monitor
/radius/incoming/monitor
/radius/monitor
/system/backup/cloud/download-file
/system/backup/cloud/remove-file
/system/backup/cloud/upload-file
/system/check-installation
/system/device-mode/update
/system/gps/monitor
/system/license/renew
/system/ntp/monitor-peers*
/system/package/update/check-for-updates
/system/package/update/download
/system/package/update/install
/system/sup-output
/system/resource/monitor
/system/ups/monitor
/tool/bandwidth-test
/tool/flood-ping
/tool/ip-scan*
/tool/mac-scan*
/tool/ping-speed
/tool/speed-test
/tool/profile*
/tool/romon/discover*
/tool/sniffer/quick*
/tool/speed-test
/tool/torch*
/tool/traceroute*
/tool/traffic-generator/inject-pcap
/tool/traffic-generator/quick*
/user-manager/monitor
/user-manager/router/monitor
/user-manager/user/monitor

‡ Items marked with * lack a do={} block for a script, but work asynchronously... Open question is it a bug if there is no do= when there are attributes like freeze-frame-interval (once/duration/etc)...

LMK if anyone sees any I'm missing...

infabo · February 22, 2026, 6:50am

7.22

/log/print/follow on-event=
/log/print/follow-only on-event=

xrlls · February 22, 2026, 7:41am

iot
- gpio
  - digital
    - script=
ipv6
- dhcp-client
  - script=
- dhcp-server
  - binding-script=

tdw · February 22, 2026, 12:54pm

/ip/dhcp-server/alert … on-alert=

Amm0 · February 22, 2026, 5:49pm

Thanks! FWIW, I'm "blind" to things not available in CHR...since my schema tools use CHR to build the command tree (and yeah no GPIO is possible). But I didn't know gpio was removed from CLI even when iot.npk is installed – never noticed.

optio · February 22, 2026, 10:16pm

Devices with WPS button have: /system/routerboard/wps-button on-event

rextended · February 23, 2026, 11:58am

They added it recently...

This way you can add events anywhere that is not yet supported, but compatible:

Amm0 · February 23, 2026, 8:51pm

... which is an improvement, while print where and find can be abused to solve same on-event... that later is clear.

FWIW, I wasn't looking for them orginally, I found the on- one easily I did add all the missing one in the top post.

I'm working on virtual FS for VSCode so you can navigate to any script location, and edit it in VSCode. Since it's virtual file system, things that are not actual "events" wasn't my focus.

Here is what I've (well, me yelling at CoPilot) show for the perisited attributes. I still need to audit with my top post, and I still have some a few throny issues to resolve when I have more time (like netwatch without name, host can be dup too & logging/action/target=script is actually a "symlink"... basically anything without a unique name attribute [so needs backs to .id/etc]).

Virtual Filesystem Structure (rscfile://)

rscfile://192.168.74.1:7080/
│
├── system/                                   (schema discovery root)
│   ├── script/                               (singleton: isList)
│   │   ├── Untitled-1                        [FILE] SystemScriptItem.source
│   │   ├── something                          [FILE] SystemScriptItem.source
│   │   └── [<new>]               
│   │
│   ├── scheduler/                            (isList: multiFilePerItem=false)
│   │   ├── aasdfasdfasdf                     [FILE] .on-event
│   │   └── [<new>]               [CREATE OK after cache sync]
│   │
│   ├── logging/
│   │   └── action/                           (isList: target=script filter)
│   │       └── actionscript                  [FILE] symlink to /system/script/Untitled-1
│   │           ^                             [SYMLINK: script= field → /system/script/name]
│   └── routerboard/                          (singleton: multiFilePerItem=true)
│       ├── mode-button/                      [DIR] button config sub-attributes
│       │   └── on-event                      [FILE] nested .mode-button.on-event
│       ├── reset-button/
│       │   └── on-event                      [FILE] nested .reset-button.on-event
│       └── wps-button/
│           └── on-event                      [FILE] nested .wps-button.on-event
│
├── interface/
│   └── vrrp/                                 (isList: multiFilePerItem=true)
│       ├── vrrp1/                            [DIR] VRRP instance
│       │   ├── on-master                     [FILE] .on-master script
│       │   └── on-backup                     [FILE] .on-backup script
│       └── [vrrp2, vrrp3, ...]/
│
│
├── ip/
│   ├── dhcp-client/                          (nameAttr=interface, template=${interface})
│   │   ├── ether1                            [FILE] DHCP script for ether1
│   │   └── ether2
│   │
│   ├── dhcp-server/                          (isList)
│   │   ├── dhcp_vlan10                       [FILE] lease-script
│   │   └── dhcp_vlan20
│   │
│   └── dhcp-server/
│       └── alert/                            (nested under /ip/dhcp-server)
│           ├── ether1-alert                  [FILE] on-alert for ether1
│           └── ether2-alert
│
├── ipv6/
│   ├── dhcp-client/                          (same as ip/dhcp-client, IPv6 variant)
│   ├── dhcp-server/                          (binding-script)
│   └── hotspot/
│       └── user-profile/                     (multiFilePerItem)
│           └── profile1/
│               ├── on-login                  [FILE]
│               └── on-logout                 [FILE]
│
├── tool/
│   ├── netwatch/                             (nameAttr=host, template=${host})
│   │   ├── 192.168.1.1/                      [DIR]
│   │   │   ├── on-up                         [FILE] up-script
│   │   │   ├── on-down                       [FILE] down-script
│   │   │   └── on-test                       [FILE] test-script
│   │   └── 10.0.0.1/
│   │
│   └── traffic-monitor/                      (multiFilePerItem)
│       ├── monitor1/
│       │   └── on-event                      [FILE]
│       └── monitor2/
│
├── ppp/
│   └── profile/                              (multiFilePerItem)
│       └── ppp_profile1/
│           ├── on-up                         [FILE]
│           └── on-down                       [FILE]
│
└── iot/
    ├── mqtt/
    │   └── subscriptions/                    (nameAttr=topic, template=${topic})
    │       ├── sensor/temp                   [FILE] on-message
    │       └── sensor/humidity               [FILE] on-message
    │
    └── gpio/
        └── digital                           [FILE] singleton script

Test-Mode Footnotes

Symbol	Meaning
`[FILE]`	Single file (read/write content)
`[DIR]`	Directory (multiFilePerItem: each attr becomes child file)
`[SYMLINK]`	Virtual symlink (opens linked script)
`${var}`	Template variable (rendered from item field)
Nested `.field.attr`	Singleton multiFilePerItem PATCH format
`nameAttr=interface`	Uses `interface` field as filename instead of `name`
`target=script filter`	REST query includes `target=script` parameter

Important: All paths are validated at startup via /console/inspect to ensure they exist on target RouterOS device (accounts for package/version differences).

List of all attributes that support scripting?

Scripts persisted in export

"Transitory Scripts"

Virtual Filesystem Structure (rscfile://)

Test-Mode Footnotes

Scripts persisted in `export`