Packets are logged only when they go to the CPU, so packets in the fastpath are not automatically logged. You must use both the mirror-cpu action modifier and the log or log-raw action modifier if you want to log both slowpath and fastpath packets that match the ACL rule entry. Additionally, Kern.Info messages (or Kern.Card.Info on SummitStack) are not logged by default. You must configure an EMS filter to log these messages, for example, configure log filter DefaultFilter add event kern.info. See the Status Monitoring and Statistics chapter for information about configuring EMS.
The log and log-raw action modifiers can be rate-limited at both the global level and individually per rule. The global rate limit applies to all logs generated by log and log-raw actions across all ACL rules and has a default value of 10 logs per 5 seconds. Use the following command to configure the global rate limit:
configure access-list action-modifier log rate-limit <burst_size> in <time_interval>
For example, to limit the total logging rate to 100 logs per hour, use the following configuration:
configure access-list action-modifier log rate-limit 100 in 3600
The time_interval parameter is specified in seconds, so 3600 seconds equals one hour. Individual log and log-raw actions within a rule can also have their own rate limits to prevent high-frequency rules from monopolizing the logging facility. When both global and rule-level rate limits are configured, logs must pass through both rate limiters before being sent to the logging facility. Rule-level rate limits prevent individual rules from consuming excessive logging capacity, while the global rate limit controls the total logging rate across all rules. See ACL Rule Syntax: Action Modifiers for information on configuring rate limits for individual rules.