topic Re: ACL log NEXUS 3000 in Switching

ACL log NEXUS 3000

marek.orlowski — Tue, 04 Jan 2022 15:53:12 GMT

Hey

I would like to monitor my ACL entries, and want to separate them.
Currently after adding them to the ACL all the logs are mixed up.
Is it possible e.g. to mark packets for a specific ACL?

Re: ACL log NEXUS 3000

balaji.bandi — Tue, 04 Jan 2022 16:24:55 GMT

Is it possible e.g. to mark packets for a specific ACL?

if all the ACL marked to Log keyword used, then all will be mixed, i do not believe any specific can be done, instead you can send the Logs to syslog server and make own scripts to standardise them as per the requirement, is this what you intend to do ?

Re: ACL log NEXUS 3000

Georg Pauwen — Tue, 04 Jan 2022 17:41:43 GMT

Hello,

you can obviously filter the output so it shows only the entries for a specifi ACL, e.g.:

show logging ip access-list cache [detail] | acl-101

would only show entries for access list acl-101.

Re: ACL log NEXUS 3000

marek.orlowski — Wed, 05 Jan 2022 11:03:00 GMT

@balaji.bandiI am currently sending logs to ELK (logstash), but I cannot show which packet is from which ACL.
A given log item has: Src. adr, Dest adr, Src port, Dest port, Src Interface and creation time.

@Georg Pauwen show logging ip access-list cache [detail] | ?

after pipe i cannot type acl

show logging ip access-list cache detail | ?
  awk          Mini AWK
  cut          Print selected parts of lines.
  diff         Show difference between current and previous invocation (creates temp files: remove them with 'diff-clean' command and dont use it on commands with big outputs, like
               'show tech'!)
  egrep        Egrep - print lines matching a pattern
  email        Email command output
  grep         Grep - print lines matching a pattern
  head         Display first lines
  human        Output in human format
  json         Output in json format
  json-pretty  Output in json pretty print format
  last         Display last lines
  less         Filter for paging
  no-more      Turn-off pagination for command output
  section      Show lines that include the pattern as well as the subsequent lines that are more indented than matching line
  sed          Stream Editor
  sort         Stream Sorter
  tr           Translate, squeeze, and/or delete characters
  uniq         Discard all but one of successive identical lines
  vsh          The shell that understands cli command
  wc           Count words, lines, characters
  xml          Output in xml format (according to .xsd definitions)
  xmlin        Convert CLI show commands to their XML formats
  xmlout       Output in xml format (according to the latest .xsd version)
  begin        Begin with the line that matches
  count        Count number of lines
  end          End with the line that matches
  exclude      Exclude lines that match
  include      Include lines that match

Re: ACL log NEXUS 3000

Georg Pauwen — Wed, 05 Jan 2022 14:50:20 GMT

Hello,

looks like you can add the keywords directly without the pipe:

show logging ip access-list cache [detail] include acl-101

Re: ACL log NEXUS 3000

marek.orlowski — Wed, 05 Jan 2022 16:08:52 GMT

It cannot work,becouse there are no information about acl:

Re: ACL log NEXUS 3000

Georg Pauwen — Wed, 05 Jan 2022 16:24:19 GMT

Hello.

I was just giving an example. You need to match on something that is actually in the output (source interface, as an example)

show logging ip access-list cache detail include Vlan100