350-001 · Question #75
After applying a new ACL on a device, its CPU utilization rose significantly and many messages starting with "%SEC-6-IPACCESSLOG" appeared on the Syslog server. What can be done to resolve this…
The correct answer is C. Remove the log keyword from each ACL entry. The 'log' keyword appended to ACL entries causes the router to generate a syslog message for every matched packet, which consumes significant CPU and produces the %SEC-6-IPACCESSLOG messages.
Question
After applying a new ACL on a device, its CPU utilization rose significantly and many messages starting with "%SEC-6-IPACCESSLOG" appeared on the Syslog server. What can be done to resolve this situation?
Options
- AIncrease memory allocation for ACLs.
- BRemove all entries from the ACL and use a single permit ip any any statement.
- CRemove the log keyword from each ACL entry.
- DReboot the device after the ACL has been applied.
How the community answered
(40 responses)- A3% (1)
- B13% (5)
- C80% (32)
- D5% (2)
Why each option
The 'log' keyword appended to ACL entries causes the router to generate a syslog message for every matched packet, which consumes significant CPU and produces the %SEC-6-IPACCESSLOG messages.
ACL matching is handled in hardware or the forwarding plane; memory allocation does not affect the CPU spike caused by software logging.
Replacing specific ACL entries with 'permit ip any any' would remove security policy and does not address the logging overhead itself.
Each time a packet matches an ACL entry that includes the 'log' keyword, the IOS process must generate and send a syslog message, which is CPU-intensive at high traffic rates. Removing the 'log' keyword from all ACL entries eliminates the per-packet logging overhead and stops the %SEC-6-IPACCESSLOG messages from flooding the syslog server.
Rebooting does not alter the ACL configuration; the same CPU spike would recur once the device is back online and traffic resumes.
Concept tested: ACL log keyword CPU impact and syslog generation
Source: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html
Topics
Community Discussion
No community discussion yet for this question.