Rule Trap and Syslog for Policy

You can be notified when a policy rule is used by enabling Syslog or trap actions:
  • The Syslog action sends an entry in the log after first rule use with the EMS tag “Policy.LogRuleHit”.
  • The trap action sends an etsysPolicyRulePortHitNotification SNMP trap to the configured trap receiver.

By default, the Syslog and trap actions only occur when the rule is first used. However, for the Syslog action, you can configure the system to send messages every time the rule is used. Show commands are available to display the list of used rules and Syslog action configuration.

Supported Platforms

Summit X450-G2, X460-G2, X670-G2, and ExtremeSwitching X440-G2, X465, X590, X620, X690, X870 series switches.

Limitations

Not supported on admin profile rules.

New CLI Commands

configure policy syslog [machine-readable machine_readable | extended-format extended_format | every-time every_time]

unconfigure policy syslog {machine-readable} {extended-format} {every-time}

clear counters policy

show policy syslog {machine-readable} {extended-format} {every-time}

configure policy autoclear {interval interval}

unconfigure policy autoclear interval

show policy autoclear interval

show policy rule port-hit {data} {detail} {wide}

Changed CLI Commands

Changes are underlined.

configure policy rule profile_index [ether ether | icmp6type icmp6type | icmptype icmptype | ip6dest ip6dest |ipdestsocket ipdestsocket | ipfrag | ipproto ipproto | ipsourcesocket ipsourcesocket | iptos iptos | ipttl ipttl | macdest macdest | macsource macsource | port port | tcpdestportIP tcpdestportIP | tcpsourceportIP tcpsourceportIP | udpdestportIP udpdestportIP | udpsourceportIP udpsourceportIP ] {mask mask } {port-string [ port_string | all]} {storage-type [non-volatile | volatile]} {drop | forward} {syslog syslog} {trap trap} {cos cos } {mirror-destination control_index} {clear-mirror}

show policy dynamic [override | syslog-default | trap-default ]

The following show command now displays rule hit counter information:

show policy rule detail