i wanted to deny traffic to 192.168.1.5 , and it matched permit statement . is that normal behaviour ?
i followed your suggestion and tryied to delete (10) entry and add it again with "log" keyword to see matches, but actully when i issued command "no 10" in acl config , switch did not have any reaction, (10) record was still there (strange).
then i complitely deleted acl and have created new one with "log" keyword on every line , (10) begin to match traffic.
10 deny ip any host 192.168.1.5 log (60 matches)
20 permit icmp any any log (284 matches)
removed acl with "log" keyword and created one more without "log" and still it was logging (10) entry
10 deny ip any host 192.168.1.5 (98 matches)
20 permit icmp any any (2 matches)