Filter Policy Logging; Filter Policy Cflowd Sampling - Alcatel-Lucent 7450 Configuration Manual

being removed from any of the line cards the policy is currently downloaded to (as result of
association change or when a filter becomes inactive), the debug statistics for the filter are reset to
0 (zero). Downloading a filter policy to a new line card keeps incrementing existing statistics.

Filter Policy Logging

SROS supports logging of the information from the packets that match given filter policy. Logging
is configurable per filter policy entry by specifying pre-configured filter log (config filter log). A
filter log can be applied to ACL filters and CPM hardware filters. Operator can configure multiple
filter logs and specify: memory allocated to a filter log destination, syslog id for filter log
destination, filter logging summarization, and wrap-around behavior.
Notes related to filter log summarization:
•
•
•
•
•
•
•
•
•

Filter Policy cflowd Sampling

Filter policies can be used to control how cflowd sampling is performed on an IP interface. If an IP
interface has cflowd sampling enabled, an operator can exclude some flows for interface sampling
by configuring filter policy rules that match the flows and by disabling interface sampling as part
of the filter policy entry configurations (interface-disable-sample). If an IP interface has cflowd
sampling disabled, an operator can enable cflowd sampling on a subset of flows by configuring
filter policy rules that match the flows and by enabling cflowd sampling as part of the filter policy
entry configurations (filter-sample).
7450 ESS Router Configuration Guide
The implementation of the feature applies to filter logs with destination syslog.
Summarization logging is the collection and summarization of log messages for 1 specific
log-id within a period of time.
The summarization interval is 100 seconds.
Upon activation of a summary, a mini-table with src/dst-address and count is created for
each type (IP/MAC).
Every received log packet (due to filter hit) is examined for source or destination address.
If the log packet (source/destination address) matches a source/destination address entry in
the mini-table a packet received previously), the summary counter of the matching address
is incremented.
If source or destination address of the log messages does not match an entry already
present in the table, the source/destination address is stored in a free entry in the mini-
table.
In case the mini-table has no more free entries, only total counter is incremented.
At expiry of the summarization interval, the mini-table for each type is flushed to the
syslog destination.
Filter Policies
Page 445