I cannot see the ACL counter event in the switch log

[Dgavin]

When creating an acl that allows traffic from two Macs and denies connecting another Mac, I do not see an event in the log when the created counter is applied.
The event counter goes up but I don't see information in the log.
The PC generates ARP broadcast traffic and every fifteen minutes in the log filter <Info:Kern.Card.Info> I see the line:

<Info:Kern.Card.Info> Slot-1: 64-byte packet from 1:2 (vlanId=xxxx) matches rule deny-other-mac: 00:xx:xx:xx:xx:xx -> 01:80 :c2:00:00:0e EtherType: 0x88cc

the counter goes up every second, with no event in the log.
What log filter would I have to configure?
sorry for my English. thank you

[BrandonC]

If you're seeing the Kern.Card.Info logs some of the time, you've got your logging config correct. I suspect the issue may be the fact that packets need to be sent to the switch CPU in order to be logged. ARP traffic makes it there by default (since it is broadcast), but unicast traffic ordinarily will not be lifted to the CPU. If you want to log all traffic denied by this ACL, you will need to add a mirror-cpu action modifier to the ACL entry.

However, be careful with this as it can lead to a lot of traffic being sent to CPU if there is a large amount of traffic hitting the ACL rule in question.

The KB article linked below goes into a bit more detail about the log action in ACLs.
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000079892

[Dgavin · Accepted solution]

Thank you very much, in the end, as you indicate, what I did was use "copy-cpu-and-drop" in the acl, also adding the UDP protocol so as not to forward all the traffic once the mac was detected.

Thank you very much again!