ACL/Syslog Deny

[roadracers]

Looking for a way to send ACL permit or deny hits to syslog only. We currently have a few routers that we need to monitor traffic out to the internet. We need to see what is permitted and what is denied. Currently, it is set up with a log command on the ACL. We would like this to be sent only to our SIEM device via Syslog and not fill up the log on the router.

Anyone have a way to do this?

[Francesco Molino]

Hi

First, before answering your question, I just want to give you an advice that logging every ACE, you might experience high CPU issues.

Then, by default, logging is done using level 7 (debugging). ACL logs are informational (level 6). If you configure logging buffer to level 5, you should be fine to not get acl logs into buffer but send to your syslog level 7 or 6 using logging trap command.

Hope that's clear !