firewall log session statistics acl

Function

The firewall log session statistics acl command enables statistics on sent and discarded session logs based on ACLs.

The undo firewall log session statistics acl command disables statistics on sent and discarded session logs based on ACLs.

Format

firewall log session statistics acl { acl-number | ipv6 acl-number } [ all-systems ]

undo firewall log session statistics acl [ ipv6 ] acl-number

Parameters

Parameter	Description	Value
ipv6	Collects statistics on IPv6 session logs based on ACLs.	-
acl-number	Specifies an ACL.	The value is an integer ranging from 2000 to 3999. The number of a basic ACL ranges from 2000 to 2999 and that of an advanced ACL ranges from 3000 to 3999.
all-systems	Collects statistics on session logs sent and discarded of all systems that ACL traffic crosses virtual systems.	The public system supports the all-systems parameter, while virtual systems do not.

Views

System view

Default Level

2: Configuration level

Usage Guidelines

By default, the function of collecting statistics on sent and discarded session logs based on ACLs is disabled.

Usage Scenario

You can run this command to accurately collect statistics on sent and discarded session logs of a specific session or several sessions. When session logs of certain sessions are lost, you can determine whether the USG6000E sends or discards session logs of the sessions.

Precautions

The collected session information depends on whether the firewall log session statistics acl command carries the all-systems parameter:

If the all-systems parameter is not configure, this command collects statistics on sent and discarded session logs of the public system or virtual system where the ACL applies. If you know the public system or virtual system where the ACL applies and you want to accurately view the information of the public system or virtual system, run the display firewall logstatistic command in the public system.
The all-systems parameter is usually used to collect statistics on discarded and sent session logs of all systems where that ACL applies. For example, ACL-matched packets pass through virtual system A from the public system, but the user does not know which virtual system or public system the packets have passed through. In this case, the user can configure the all-systems parameter in the public system and then run the display firewall log statistic command to view the session log information about both the public system and virtual system A.

acl-number specifies the ACL matched by sessions. The ACL can contain up to 128 rules.

Statistics on session logs in binary and syslog formats can be collected based on ACLs. Configuring ACL-based statistics on sent and discarded session logs affects the device performance. Use this function based on the actual situation.

Example

# Enable session log statistics based on ACL 3001.

<sysname> system-view
[sysname] firewall log session statistics acl 3001 all-systems