I was not managed to get it work
First, I want to test it via specific rule, so I have created new rule with Track: "Alert". My understanding is that the script located in /var/log/test.sh should be executed every time this specific rule is matched.
My settings in Global Properties:
According logs, the specific traffic is matched and I also see Alert in logs. The only problem is that it didnt activate the script.
I also tried to set Track as "UserDefined" and with this setup, the script was executed.
Is there any way how to do the same just for Alert (as in Anti-spoofing in R77.30 there are only following options available):