What is a LEF Profile?

A LEF Profile is a configuration object on a Versa Operating System (VOS) device that specifies which log export template – IPFIX or syslog – and which collector or collector group receive a tenant’s exported logs. Administrators associate a LEF Profile with a feature, service, or policy rule, or designate one as the organization’s default.

Key takeaways

• A LEF Profile tells a VOS device where and how to export logs.
• It pairs a log export template (IPFIX or syslog) with a collector.
• One LEF Profile per tenant can be designated the default profile.
• Features, services, and policy rules each reference a LEF Profile.
• Collectors can be grouped for high availability across destinations.

On this page: Why it matters · How it works · Types · LEF Profile & Versa · FAQ

Why is a LEF Profile important?

By default, VOS devices export no log data at all. Every feature and service on the device generates logs internally, but nothing leaves the box for Analytics, a syslog server, or a NetFlow collector until an administrator explicitly wires up a destination – and the LEF Profile is the object that does the wiring. Without one, dashboards stay empty, reports have nothing to draw on, and troubleshooting a session or a policy hit has no log trail to follow.

The LEF Profile also carries the operational decisions that make log export usable at scale: which collector or collector group receives the traffic, and whether TCP or UDP, syslog or IPFIX, is the right transport for that destination. In a multitenant deployment, this matters even more – each tenant’s logs can be routed to its own collector, so a provider hosting many customers on shared infrastructure can still keep every tenant’s log stream separate and correctly attributed.

Getting the LEF Profile right is also what keeps log volume manageable: a profile with the wrong collector, or none at all, either floods the wrong destination or silently drops data that operators assume is being captured.

What is a LEF Profile?

A LEF Profile sits at the top of a small configuration chain. First, a template declares the export format – IPFIX for Analytics nodes and NetFlow collectors, or syslog for syslog servers. Second, a collector defines a destination: an IP address or FQDN, a port, and a transport protocol (TCP or UDP), often pointing at an Application Delivery Controller service that distributes connections across multiple collector nodes. Collectors can be combined into a collector group for high availability, so a backup destination takes over if the primary is unreachable.

The LEF Profile itself references a collector or collector group, along with a name, description, and optional tag, and can be flagged as the organization’s default profile – or, separately, as the default specifically for alarm logs. Once configured, the profile is selected wherever a feature, service, or policy rule needs to send its logs somewhere.

Types of LEF Profiles

The documentation describes LEF Profiles by the role they play rather than by a fixed category list. A default LEF Profile is the organization-wide fallback: once assigned, it automatically receives alarm logs, LTE summary logs, MOS summary logs, SD-WAN SLA metrics, traffic-conditioning logs, and system logs with no further per-feature configuration required. A default-for-alarms profile is a narrower variant, available since Release 22.1.1, that lets alarm logs go to a different destination than the general default – only one profile can hold this role at a time.

Beyond the defaults, a feature- or policy-specific LEF Profile is explicitly selected when configuring an individual feature, service, or policy rule – ATP, CGNAT, DLP, DNS filtering, EIP, firewall rules, packet capture, and traffic-monitoring policy each have their own LEF Profile field, letting that log stream override the default and go to a different collector entirely.

LEF Profile & Versa

LEF Profiles are configured in Director under Configuration > Objects & Connectors > Connectors > Reporting > Logging Export Function, on the Profiles tab, after the template, collector, and (optionally) collector group are in place – the mechanics are covered in Configure Log Export Functionality. Once created, a LEF Profile is selected across the platform: in NGFW security policy rules, logging control settings, ATP and DLP profiles, DNS and file filtering, EIP profiles, packet capture rules, and traffic-monitoring policy, as detailed in Apply Log Export Functionality.

Multitenancy is built into the model: a provider can give each tenant its own default LEF Profile and collector, keeping every customer’s log stream isolated even when the underlying gateway hardware and Analytics infrastructure are shared.

Frequently asked questions

What is the difference between a LEF Profile and a LEF collector?

A collector defines a destination – an IP address or FQDN, port, and transport protocol that logs are sent to. A LEF Profile is the object that features and policies actually reference; it points to a collector (or collector group) and adds naming, tagging, and default-role settings on top of it.

Can one VOS device have more than one LEF Profile?

Yes. A device can have several LEF Profiles, each pointing at a different collector or collector group. One can be designated the organization’s default, and optionally a separate one can be designated the default for alarm logs specifically, while others are reserved for individual features or policy rules.

What happens if no LEF Profile is configured on a VOS device?

Nothing is exported. VOS devices generate logs internally regardless of configuration, but without at least a default LEF Profile pointing at a collector, none of that data reaches Analytics, a syslog server, or a NetFlow collector, leaving dashboards and reports empty.

Can a LEF Profile send logs to more than one destination?

Yes, indirectly. A LEF Profile references a collector group rather than a single collector, and collector groups can include several destinations for high availability. Releases from 21.2.1 onward also support collector group lists, sending logs to multiple groups from one profile.

Which log types are exported automatically without extra per-feature configuration?

Once a default LEF Profile is assigned, alarm logs, LTE summary logs, MOS summary logs, SD-WAN SLA metrics, traffic-conditioning logs, and system logs are all forwarded to its collector automatically. Every other log type needs its feature or policy explicitly configured with a LEF Profile.

More on LEF Profiles

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about LEF Profiles, these are worth looking at next.