ACI Contract Permit/Deny Syslog Logging - Not Working

[maced129]

Hello,

We are trying to get our contracts between EPGs to log the deny and permit traffic as seen within the Tenant > $tenant > Operational > Packets > L3 Permits/L3 Denys.

According to the obscure documentation it seems that one of the key things that needs to happen to send these logs to syslog is to reassign the default logging facility to "information" and enable the fabric monitoring policy. We see syslog on our syslog server, just not for the contract permits and denys. Changing the default to facility to "information" did not work and we have gone down a rabbit hole of enabling the monitoring policy in every possible place (Fabric/Fabric Access/Tenant/AP/EPG/BD) and still no luck. I don't see the messages popping up in /var/log/external/messages on the leafs either..

Any ideas?

Thanks

[Sergiu.Daniluk]

Hi @maced129 

If you wish to start the contract logging, you need to enable the log directive under the filter chain:

Double click on the filter entry from contract subject.

Stay safe,

Sergiu

[maced129]

Unfortunately, no luck there - all contracts applied to the EPG have log directive enabled. 

[maced129 · Accepted solution]

Agh....seems to be a bug with our current version of Leafs

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv11292