Testing and troubleshooting ACLs
You can monitor ACL performance by using the logging option (which generates log messages when there is a "deny" or “permit” ACE match) and the ACE statistics counters (which maintain running totals of the packet matches on each ACE in an ACL).