When all rules are within the resource limit, the command reports no dropped rules:
inspect priority-policy dropped
Priority Policy Resource Usage:
Resource Limit : 1350000
Required Resources : 409
Adjusted Resource Use : 409
Non-Optimized Resource Use : 409
No dropped rules found.
When the resource limit is exceeded, the command lists each dropped rule:
inspect priority-policy dropped
Priority Policy Resource Usage:
Resource Limit : 400
Required Resources : 409
Adjusted Resource Use : 400
Non-Optimized Resource Use : 409
Priority Policy Rule : 15302035782090225 : MKC-Policy
Policy Set : 15302033124150094 : MKC-PolicySet3
Stack Index : 0
Application Count : 2
Source Prefix Count : 2
Source Prefix : 15209663164520010 : EnterpriseGlobalPrefix
Destination Prefix Count : 1
Destination Prefix : 15287319348610122 : GlobalPrefix10
Resource Count : 4
Priority Policy Rule : 15300315132120195 : xmpp-server-Policy
Policy Set : 15300315130730009 : MKC-OrigPolicySet1
Stack Index : 1
Application Count : 1
Source Prefix : none
Destination Prefix : none
Resource Count : 1
...
Output Fields
- Resource Limit: The maximum number of resources the device can allocate across all priority policy rules.
- Required Resources: The total resources the device needs to enforce all configured rules without optimization.
- Adjusted Resource Use: The actual resources the device uses after applying optimization. If this equals the resource limit, the device has dropped rules.
- Non-Optimized Resource Use: The resources the device would need without optimization.
- Priority Policy Rule: The numeric ID and name of the dropped rule.
- Policy Set: The ID and name of the policy set the dropped rule belongs to.
- Stack Index: The position of the dropped rule within the policy set stack.
- Application Count: The number of applications the dropped rule matches.
- Source Prefix Count / Source Prefix: The number of source prefixes and the prefix list ID and name, or none if the rule has no source prefix.
- Destination Prefix Count / Destination Prefix: The number of destination prefixes and the prefix list ID and name, or none if the rule has no destination prefix.
- Resource Count: The resource cost of this specific rule.
Troubleshooting
| Condition | Possible Cause | Action |
|---|
| High-priority business rules are being dropped instead of low-priority ones | The device generally drops the highest-cost rules regardless of business priority or rule ordering | Reduce the resource cost of critical rules by using smaller prefix lists or narrower application scope; consider splitting the policy set |
| Required Resources is only slightly above Resource Limit | A recent policy change pushed resource usage just over the limit | Identify the most recently added high-cost rules using the Resource Count field and simplify them to bring Required Resources below the limit |
