How to log matched traffic in an ACL

[Thiago]

The log keyword of an ACL doesn't seem to work, take this simple policy as an example:

entry permit_ICMP {
if {
protocol icmp;
}
then {
permit;
mirror-cpu;
log;
count icmp;
}
}

The counter increments fine, the traffic is permitted (even with a deny any in the end) but there's no log.

Looking forward for an answer for this.

Thanks in advance.

[Sumit_Tokle]

@ paul is absolutely correct.

It's better to use EMS instead of mirror traffic to CPU.

[Thiago]

Thank you Paul,

When I added "configure log filter DefaultFilter add event kern.info" it started to appear in the log.

[Paul_Russo]

Hello Thiago

That log is not to log that the entry was executed in the switch log table. it means you can send the packet to the CPU and get header information in the log table.

"log—Logs the packet header."
"log-raw—Logs the packet header in hex format."

In order to have that data execute into the log you need to add a filter

"You must configure an EMS"
"filter to log these messages, for example, configure log filter DefaultFilter add event kern.info. See the Status Monitoring and Statistics chapter for information about"

To test that an entry is working use the counter

Hope that helps
P