The ACL packet log rate-limiting feature provides configurable control over the logging frequency for packets that match ACL rules with log and log-raw action modifiers. Configure rate limits at both global and individual rule levels to prevent log saturation and manage logging facility resources.
Issue: Packet logs generated by ACL rule action modifiers log and log-raw have a fixed rate limit of 10 logs per 5 seconds. This fixed rate prevents operators from adjusting logging intensity based on individual rules or network requirements. A single high-frequency rule can monopolize the EMS and Syslog logging facilities, preventing logs from other rules and system events from being recorded.
Resolution: The ACL packet log rate-limiting feature allows configuration at two levels that work together: a global default that limits all ACL packet logs, and rule-specific rate limits that prevent individual rules from consuming excessive logging facility resources. Operators can specify burst size and time interval parameters at each level to control logging frequency based on deployment requirements and traffic patterns.
Key Capabilities:
log and log-raw action modifiersGlobal Rate Limiting
Configure the default rate-limit policy for all ACL packet logging:
configure access-list action-modifier log rate-limit <burst_size> in <time_interval>
Rule-Level Rate Limiting
Configure the rate-limit for a specific ACL rule by including the rate-limit parameter in the rule action block:
log { rate-limit <burst_size> in <time_interval> }
Example Rule Configuration
entry packet_log { if { destination-address 10.1.1.0/24; protocol udp; } then { log rate-limit 1 in 5; mirror-cpu; } }
This rule logs one packet per 5 seconds for UDP traffic destined to 10.1.1.0/24. Logs from this rule and all other rules are still subject to the global rate-limit setting.
All platforms.