ACL Log is not sending to syslog server

[chong.eric]

Hi I have enabled a log on ACL as below ip access-list extend CAPTURE_BATCH_1_VLAN_103 permit tcp host 172.16.101.108 any gt 0 log permit tcp host 172.16.101.109 any gt 0 log permit ip any any when i do "show log" in the switch, I can see the ACL log in the buffered. When I check on the syslog server, there is no log for ACL, but I can see other logs in the syslog server please advise

[Flavio Miranda]

Hi,

 How is logging ocnfigured on this Switch? The other logs you see on the syslog server is from this switch?

-If I helped you somehow, please, rate it as useful.-

[chong.eric]

Hi

logging buffered informational
logging console informational
logging monitor informational
logging source-interface Vlan1
logging 172.17.200.11
logging 172.16.1.80
logging 172.16.101.178
logging 172.16.107.21

Yes...the log i see in the syslog is from the same switch.

[joshua.a.tryon]

I'm having the same problem on a Cisco 2911 router where it's logging the ACL hits but they are not going to the syslog server.  Other log messages such as configuration changes, ssh access are going to the syslog server.  I've tried "ip access-list logging interval 1", various "logging trap" levels, but nothing works.  Thoughts?

[MKH]

Hi

I have the same problem.

Thank you.

[MKH]

Hi

My problem solved. I add ip access-group in both side (in and out).

Please share your logging config if your problem haven't solved yet .

Thank you. 

[MKH]

Hi 

I have the same problem.

As you ask,other logs go to  the syslog server from this switch, but ACL log doesn't go.

Thank you.

[albert_sze]

Hello everyone, i have the same issue. Were you able to figure out why config messages are being sent but not ACL hits?

[MKH]

Hi

Because your configuration changes accrued in control plane, but your ACL traffic are in data plane.

You have to apply your ACL on interface/interfaces for out/in traffic.

Good luck.