Lenovo ThinkSystem NE2552E, Application Manual

Page: 128 / 574

128
NE2552E Application Guide for ENOS 8.4
Logged Information
When ACL logging is enabled on any particular ACL, the switch will collect
information about packets that match the ACL. The information collected depends
on the ACL type:
 For IP ‐ based ACLs, information is collected regarding

Source IP address

Destination IP address

TCP/UDP port number

ACL action

Number of packets logged
For example:
Aug 21 15:30:43 TA_22 NOTICE ACL-LOG: %IP-NEW Src IP:
40.0.0.8, Dst IP: 40.0.0.1, Src Intf: EXT5, ACL: list 10,
Action: deny, Hit-count: 1
 For MAC ‐ based ACLs, information is collected regarding

Source MAC address

Source IP address

Destination IP address

TCP/UDP port number

ACL action

Number of packets logged
For example:
Aug 21 15:34:49 TA_22 NOTICE ACL-LOG: %MAC-NEW Src MAC:
00:00:00:00:01:05, Dst MAC: a4:8c:db:d4:51:01, Src IP:
12.13.14.15, Dst IP: 16.17.18.19, Src Intf: EXT5, ACL: list
10, Action: deny, Hit-count: 1
Log Interval
For each log ‐ enabled ACL, the first packet that matches the ACL initiates an
immediate message in the system log. Beyond that, additional matches are subject
to the log interval. By default, the switch will buffer ACL log messages for a period
of 300 seconds. At the end of that interval, all messages in the buffer are written to
the system log. The global interval value can be changed as follows:
Where the interval rate is specified in seconds.
In any given interval, packets that have identical log information are condensed
into a single message. However, the packet count shown in the ACL log message
represents only the logged messages, which due to rate ‐ limiting, may be
significantly less than the number of packets actually matched by the ACL.
Also, the switch is limited to 64 different ACL log messages in any interval. Once
the threshold is reached, the oldest message will be discarded in favor of the new
message, and an overflow message will be added to the system log.
NE2552E(config)# logging ip access-list cache interval
<5 ‐ 86400>