ACL logging operation
When the switch detects a packet match with an
ACE and the ACE includes either the deny or permit action
and the optional log parameter, an ACL log message
is sent to the designated debug destination.
The first time a packet matches an ACE with deny or permit and log configured,
the message is sent immediately to the destination and the switch
starts a wait-period of approximately five minutes. (The exact duration
of the period depends on how the packets are internally routed.) At
the end of the collection period, the switch sends a single-line summary
of any additional “deny” or “permit” matches for that ACE (and any
other “deny” or “permit” ACEs for which the switch detected a match).
If no further log messages are generated in the wait-period, the switch suspends the timer and resets itself to send a message as soon as a new “deny” or “permit” match occurs. If subsequent packets matching the already logged ACL entries are detected, then a new logged event will be generated that summarizes the number of packets that matched each specific entry (with the time period). The data in the message includes the information illustrated in Content of a message generated by an ACL-deny action.
