This feature allows generating the syslog message for the packets matching deny rules in egress ACLs. This can be enabled using the log keyword when configuring a deny ACL rule. A copy of the packet matching such deny ACL rule is sent to the control plane, where a syslog entry for the packet header is generated.