Access List Violation Logs

With traffic filtering and access control ACLs, you should consider logging packets that violate the filtering criteria. Older Cisco IOS software versions use the log keyword option, which captures the IP addresses and port numbers of packets matching an access list entry. Newer IOS versions use the log-input keyword, which adds receiving interface information and the MAC address of the host that sent it.

To manage file size and minimize performance impacts, configure logging for those critical access list entries. Don’t log entries that will match a large number of packets and generate little useful information, such as the permit any statement.