Hit counts will increment independent of logging being set. Logging will additionally generate a syslog message.
Hit counts are not retained across a reboot so a zero count is implicitly "since last boot" (or manual clear of the counts).
Reference (from ASA but the same logic applies): https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html#wp3307265190
|
log [[level ] [interval secs ] | disable | default ]
|
(Optional) Sets logging options when an ACE matches a packet for network access (an ACL applied with the access-group command). If you enter the log keyword without any arguments, you enable system log message 106100 at the default level (6) and for the default interval (300 seconds). If you do not enter the log keyword, then the default system log message 106023 is generated for denied packets. Log options are:
-
level —A severity level between 0 and 7. The default is 6 (informational). If you change this level for an active ACE, the new level applies to new connections; existing connections continue to be logged at the previous level.
-
interval secs —The time interval in seconds between syslog messages, from 1 to 600. The default is 300. This value is also used as the timeout value for deleting an inactive flow from the cache used to collect drop statistics.
-
disable —Disables all ACE logging.
-
default —Enables logging to message 106023. This setting is the same as not including the log option.
|
