Cisco 7k acl and hit count....

[mbaars]

Hi All,

Seeing a strange access-list hitcount issue on Nexxus 7k running 7.3(5).

Within an access-list there are some acl entries not showing any matches. For an acl entry without matches it would say '[match=0]' but for some lines this is omitted. Any ideas? Is there some logging restriction on the maximum of acl entries or a bug that i should be aware of? We have a lot of acl's on this Nexxus 7k that need to be analysed and unused entries removed.

Example

N7K-01# sh access-list vlan22-in

IP access list vlan99-in
statistics per-entry
<omitted>
1700 permit ip 10.101.22.0/24 10.101.5.0/24 [match=300150756]
1710 permit ip 10.101.22.0/25 10.247.0.0/16 [match=0]
1720 permit ip 10.101.22.22/32 52.239.137.36/32 <<<<<< no match/hitcounter
1730 permit ip 10.101.22.105/32 10.101.3.0/24 <<<<<< no match/hitcounter
1740 permit ip 10.101.22.0/25 10.111.96.0/24 <<<<<< no match/hitcounter
1750 permit ip 10.101.22.0/25 10.111.97.0/24 <<<<<< no match/hitcounter

[balaji.bandi]

Do you have any traffic that matches the ACL?

[mbaars]

Good question

I am assuming there is matching traffic.

But even so, without matching traffic i would expect '[match=0]' to be included when viewing the acl?

[balaji.bandi]

I am assuming there is matching traffic.  - need confirmation or create another ACL you known device and test it.

[MHM Cisco World]

statistics <<- add this command under the ACL again, and share the result 

[mbaars]

I removed ' statistics per-entry' under the acl and added it again but the result is still the same....

[MHM Cisco World]

I check the ciscolive slides 
the PACL with statistics per-entry show match for all line 

the RACL with statistics per-entry show match only for traffic hit the line other line dont show match if there is no traffic hit the line