diff --git a/CHANGES-4.3.md b/CHANGES-4.3.md
index 673dbef8a..f136b7835 100644
--- a/CHANGES-4.3.md
+++ b/CHANGES-4.3.md
@@ -39,6 +39,8 @@ File format:
 - Added a test to prevent a last will testament message to be
   published when a client is denied connection. [#8894](https://github.com/emqx/emqx/pull/8894)
 
+- Add warning log if the acl check of a subscribed topic failed. [#9124](https://github.com/emqx/emqx/pull/9124)
+
 ### Bug fixes
 
 - Fix delayed publish inaccurate caused by os time change. [#8908](https://github.com/emqx/emqx/pull/8908)
diff --git a/src/emqx_channel.erl b/src/emqx_channel.erl
index b8f3c5b2c..3e20c7fef 100644
--- a/src/emqx_channel.erl
+++ b/src/emqx_channel.erl
@@ -1501,12 +1501,15 @@ check_pub_caps(#mqtt_packet{header = #mqtt_packet_header{qos    = QoS,
 check_sub_acls(TopicFilters, Channel) ->
     check_sub_acls(TopicFilters, Channel, []).
 
-check_sub_acls([ TopicFilter = {Topic, _} | More] , Channel, Acc) ->
+check_sub_acls([ TopicFilter = {Topic, SubOpts} | More] , Channel, Acc) ->
     case check_sub_acl(Topic, Channel) of
         allow ->
             check_sub_acls(More, Channel, [ {TopicFilter, 0} | Acc]);
         deny ->
-            check_sub_acls(More, Channel, [ {TopicFilter, ?RC_NOT_AUTHORIZED} | Acc])
+            ReasonCode = ?RC_NOT_AUTHORIZED,
+            ?LOG(warning, "Cannot subscribe ~s with options ~p due to ~s.",
+                 [Topic, SubOpts, emqx_reason_codes:text(ReasonCode)]),
+            check_sub_acls(More, Channel, [ {TopicFilter, ReasonCode} | Acc])
     end;
 check_sub_acls([], _Channel, Acc) ->
     lists:reverse(Acc).