SR OS supports logging of the information from the packets that match a specific filter policy. Logging is configurable per filter policy entry by specifying preconfigured filter log (config>filter>log). A filter log can be applied to ACL filters and CPM hardware filters. Operators can configure multiple filter logs and specify: memory allocated to a filter log destination, syslog ID for filter log destination, filter logging summarization, and wrap-around behavior.
Notes related to filter log summarization:
The implementation of the feature applies to filter logs with destination syslog.
Summarization logging is the collection and summarization of log messages for one specific log ID within a period of time.
The summarization interval is 100 seconds.
Upon activation of a summary, a mini-table with src/dst-address and count is created for each type (IPv4/IPv6/MAC).
Every received log packet (because of filter match) is examined for source or destination address.
If the log packet (source/destination address) matches a source/destination address entry in the mini-table, from a packet received previously, the summary counter of the matching address is incremented.
If source or destination address of the log messages does not match an entry already present in the table, the source/destination address is stored in a free entry in the mini-table.
In case the mini-table has no more free entries, only total counter is incremented.
At expiry of the summarization interval, the mini-table for each type is flushed to the syslog destination.
Operational note:
Conditional action match criteria filter entries for ttl, hop-limit, packet-length, and payload-length support logging and statistics when the condition is met, allowing visibility of filter matched and action executed. If the condition is not met, packets are not logged and statistics against the entry are not incremented.