John,
instead of seeing the accounting output, you want to see the sources of big sized packets in your syslog messages.
so here comes the second method to achieve that.
forget about the PBR and the loopback for a while...
in order to generate syslog messages via acls there should be a way of matching these packets with acls. but there is no way to match packet length with an acl. so what we can do is, mark the packets ingress -to have something to match with acl - and use that to match with an acl, and so to generate logs while packets are leaving the router.
Example...
u can use,
class-map x
match packet length min max
!
policy-map mark
class-map x
set ip precedence 4
and apply this ingress to the ingress interface.
then create an acl like
access-l 100 permit ip a a precedence 4 log
access-l 100 permit ip a a
apply this to out interfaces
ip access-group 100 out
you will see your packets are marked and logged.
Ozgur
