A read-create setting specifying the action to take once the number of learned MAC addresses reaches the lower prvtMacSecLrnProfWatermarkCount threshold, before the hard maximum is hit. This gives an admin an early-warning enforcement step, such as logging or notifying, distinct from and less severe than the action taken at the hard maximum count. An admin might configure this to generate a syslog message when the watermark is crossed, giving advance notice before the port hits its hard MAC limit.