topic How to log matched traffic in an ACL in ExtremeSwitching (EXOS/Switch Engine)

How to log matched traffic in an ACL

Thiago — Wed, 24 Sep 2014 02:26:00 GMT

The log keyword of an ACL doesn't seem to work, take this simple policy as an example:

entry permit_ICMP {
if {
protocol icmp;
}
then {
permit;
mirror-cpu;
log;
count icmp;
}
}

The counter increments fine, the traffic is permitted (even with a deny any in the end) but there's no log.

Looking forward for an answer for this.

Thanks in advance.

RE: How to log matched traffic in an ACL

Paul_Russo — Wed, 24 Sep 2014 03:04:00 GMT

Hello Thiago

That log is not to log that the entry was executed in the switch log table. it means you can send the packet to the CPU and get header information in the log table.

"log—Logs the packet header."
"log-raw—Logs the packet header in hex format."

In order to have that data execute into the log you need to add a filter

"You must configure an EMS"
"filter to log these messages, for example, configure log filter DefaultFilter add event kern.info. See the Status Monitoring and Statistics chapter for information about"

To test that an entry is working use the counter

Hope that helps
P

RE: How to log matched traffic in an ACL

Thiago — Wed, 24 Sep 2014 03:04:00 GMT

Thank you Paul,

When I added "configure log filter DefaultFilter add event kern.info" it started to appear in the log.

RE: How to log matched traffic in an ACL

Sumit_Tokle — Wed, 24 Sep 2014 06:09:00 GMT

@ paul is absolutely correct.

It's better to use EMS instead of mirror traffic to CPU.