Dell EMC SmartFabric OS10 User Guide Release 10.5.0

ACL logging

You can configure ACLs to filter traffic, drop or forward packets that match certain conditions. The ACL logging feature allows you to get additional information about packets that match an access control list entry (ACE) applied on an interface in inbound direction.

OS10 creates a log message that includes additional information about the packet, when a matching packet hits a log-enabled ACL entry.

ACL logging helps to administer and manage traffic that traverses your network and is useful for network supervision and maintenance activities.

High volumes of network traffic can result in large volume of logs, which can negatively impact system performance and efficiency.

You can specify the threshold after which a log is created and the interval at which the logs must be created.

The threshold defines how often a log message is created after an initial packet match. The default is 10 messages. This value is configurable and the range is from 1 to 100 messages.

By default, the interval is set to 5 minutes and logs are created every 5 minutes. During this interval, the system continues to examine the packets against the configured ACL rule and permits or denies traffic, but logging is halted temporarily. This value is configurable and the range is from 1 to 10 minutes.

For example, if you have configured a threshold value of 20 and an interval of 10 minutes, after an initial packet match, the 20th packet that matches the ACL entry is logged. The system then waits for the interval period of 10 minutes to elapse, during which time no logging occurs. Once the interval period elapses, the 20th packet that matches the ACL entry is logged again.