ACL counters not showing

[Rich6]

Hi, I have an ACL defined to manage general access between subnets across switches, and as part of that some rules have counters assigned to them. The problem I am having is that when I use the show access-list counter command, not all of my counters are showing and I get a list that lookes similar to the below :

# show access-list counter
Policy Name Vlan Name Port Direction
Counter Name Packet Count Byte Count
==================================================================
ACCESS_CONTROL * * ingress
Rule1 163
Rule2 0
Rule3 0
not well-formed (invalid data)

if anyone can help I would like to know why it says "not well-formed (invalid data)"
Also if anyone has experience with defined counters not appearing...

i have compared ACL defined rules and cannot see any obviuos syntax differences between rules where the counter works and rules where it does not.. i havwe working counters and non working counters from rules both pretty much identical to the below:

entry Rule1 {
if {
source-address x.x.x.x;
destination-address y.y.y.y;
}
then {
permit;
count Rule1-Counter;
}
}

Any comments appreciated

Thanks

[Jarek]

Do you use any special characters in the counter name
like " & .(dot ) + - _ % ", etc ?

Or the counter name contains only a-z A-Z 0-9 ?

--
Jarek

[Rich6]

OK all... Thanks for all your replies. Its all good info 🙂

• I have checked the policy syntax with the check policy xxx command and check policy xxx access-list command all pass OK.
• I have refreshed the policy each time
• I have tried show access-list counter as well as specifying ingress|egress and cannot see some defined counters
• I have looked at the policy characters, name lengths etc... and compared some working rule counters with non workers and cannot really see any "character convention" or line length issues which contravene a working rule...

i am now wondering if I have hit a limit on the number of cou nters I can define in an ACL? Does anyone know if limitations are in force for this?

• The "not well formed" statement at the bottom of my displayed counters still bothers me. Does anyone else see this?
• The counters I can see in the list seem to be random and not as if the first 8 in the ACL work (which would be more logical).

The main L3 devices using this ACL are X670V-48x on 16.1.3.6

Thanks in advance...

[Jarek]

Hi Rich,

can you post:
1) what EXOS you use and the switch ?
2) you see that issue only on one device or more ?
3 if you have more devices, they have the same EXOS ?

--
Jarek

[Ariyakudi_Srini]

Hi Rich,

Just to be sure that the entire policy has been written correct, please check if the policy is good with the command below,

#check policy (the extenstion is not necessary in this command).

If the policy is good, the output should be something similar to below,

# check policy HTTP-RETURN --- (HTTP-RETURN is my sample policy name)
Policy file check successful.

[Karthik_Mohando]

Hi Rich,

If the ACL is applied in the egress direction then you need to check the counter with the command
"show access-list counter egress"

Can you check if this helps!