topic Re: ACL Log is not sending to syslog server in Network Security

ACL Log is not sending to syslog server

chong.eric — Fri, 21 Feb 2020 14:40:53 GMT

Hi I have enabled a log on ACL as below ip access-list extend CAPTURE_BATCH_1_VLAN_103 permit tcp host 172.16.101.108 any gt 0 log permit tcp host 172.16.101.109 any gt 0 log permit ip any any when i do "show log" in the switch, I can see the ACL log in the buffered. When I check on the syslog server, there is no log for ACL, but I can see other logs in the syslog server please advise

Re: ACL Log is not sending to syslog server

Flavio Miranda — Wed, 08 Nov 2017 22:13:02 GMT

Hi,

How is logging ocnfigured on this Switch? The other logs you see on the syslog server is from this switch?

-If I helped you somehow, please, rate it as useful.-

Re: ACL Log is not sending to syslog server

chong.eric — Thu, 09 Nov 2017 02:44:57 GMT

Hi

logging buffered informational
logging console informational
logging monitor informational
logging source-interface Vlan1
logging 172.17.200.11
logging 172.16.1.80
logging 172.16.101.178
logging 172.16.107.21

Yes...the log i see in the syslog is from the same switch.

Re: ACL Log is not sending to syslog server

joshua.a.tryon — Tue, 23 Jan 2018 16:01:16 GMT

I'm having the same problem on a Cisco 2911 router where it's logging the ACL hits but they are not going to the syslog server. Other log messages such as configuration changes, ssh access are going to the syslog server. I've tried "ip access-list logging interval 1", various "logging trap" levels, but nothing works. Thoughts?

Re: ACL Log is not sending to syslog server

MKH — Wed, 28 Mar 2018 11:43:47 GMT

I have the same problem.

As you ask,other logs go to the syslog server from this switch, but ACL log doesn't go.

Thank you.

Re: ACL Log is not sending to syslog server

MKH — Wed, 28 Mar 2018 11:51:15 GMT

I have the same problem.

Thank you.

Re: ACL Log is not sending to syslog server

MKH — Wed, 28 Mar 2018 13:30:51 GMT

My problem solved. I add ip access-group in both side (in and out).

Please share your logging config if your problem haven't solved yet .

Thank you.

Re: ACL Log is not sending to syslog server

albert_sze — Wed, 14 Nov 2018 21:53:23 GMT

Hello everyone, i have the same issue. Were you able to figure out why config messages are being sent but not ACL hits?

Re: ACL Log is not sending to syslog server

MKH — Wed, 21 Nov 2018 16:13:21 GMT

Because your configuration changes accrued in control plane, but your ACL traffic are in data plane.

You have to apply your ACL on interface/interfaces for out/in traffic.

Good luck.