Versa Advanced Logging Service (ALS) is a Versa-managed, cloud-hosted logging service that offloads high-volume logs – such as flow and web-monitoring logs – from on-premises Analytics clusters. It provides on-demand scaling, secure transport, and additional retention beyond local capacity, subscribed in multiples of 1 TB per region.
Key takeaways
- ALS is a Versa-managed, cloud-hosted service for high-volume logs.
- Offloads flow, web, DNS, and CGNAT logs from local Analytics clusters.
- Branch logs reach ALS over IPsec tunnels through the Controller’s ADC.
- Subscribed in multiples of 1 TB per region, for predictable pricing.
- Local Analytics still shows ALS data through a connector, single pane.
On this page: Why it mattersHow it worksALS componentsALS & Versa AnalyticsFAQ
Why is ALS important?
On-premises Analytics clusters are sized for typical log volumes, but the categories that matter most for forensics and troubleshooting – full flow and web-monitoring logs – can spike unpredictably. Keeping pace on-premises means large clusters with dedicated compute, fast disk I/O, and a specialized team to maintain them. ALS moves that burden to Versa: the highest-volume categories offload to a Versa-managed cloud cluster that scales on demand, without the customer provisioning hardware or staffing for it.
It also matters for retention. Forensic investigations and regulatory audits often need log history well beyond what an on-premises cluster can economically hold. ALS adds that headroom while keeping the data reachable through the same Analytics interface, so administrators keep the single-pane view they already use instead of switching tools to look further back.
What is ALS?
ALS is a Versa-managed set of cloud-hosted clusters that receive logs directly from on-premises branch devices. A branch VOS device sends its regular logs to the local Analytics cluster through its SD-WAN Controller node as usual, and a second LEF profile steers high-volume log types – flow and web-monitoring traffic among them – over a separate path to ALS. On the Controller, an ADC service load-balances these LEF connections across IPsec tunnels to the ALS cluster’s collectors, which forward the logs into the ALS engine for storage.
The on-premises Analytics cluster stays the interface administrators already use: a connector configured between it and the ALS cluster lets Analytics retrieve ALS-held data through its own APIs, so dashboards, reports, and log screens display ALS-hosted logs the same way they display locally stored ones.
ALS components
Getting logs to ALS runs through four pieces. On the branch VOS device, a dedicated LEF collector – or collector group, for redundancy – and LEF profile steer specific log types toward ALS. Recommended categories include access, antivirus, CGNAT, DHCP, DNS-filtering, file-filtering, traffic-monitoring, IDP, IP-filtering, packet-capture, SSL, and URL-filtering logs.
On the Controller node, IPsec tunnels to the ALS cluster’s virtualized network functions carry that traffic securely, and an ADC service load-balances the LEF connections across redundant tunnels. In the cloud, the ALS cluster’s collectors receive the logs and hand them to the ALS engine for storage and indexing. Finally, a connector configured on the on-premises Analytics cluster retrieves ALS data through its APIs, so existing dashboards, reports, and log screens keep working unchanged.
ALS & Versa Analytics
ALS is one of three destinations a SASE tenant can choose per log category. Firewall, web, DNS, and CGNAT logs each select independently between Analytics (processed on the local cluster), Advanced Logging Service (processed in Versa’s cloud cluster), or Archive (stored in the ALS cluster but left unprocessed, usable only for offline analysis). A provider organization configures the LEF profile for whichever option it picks; Archive requires a separate profile from the ALS option.
Business report templates in the Analytics application, including reports covering ALS usage itself, read from whichever cluster holds the underlying data, and Analytics’ data-retention settings interact with ALS to determine how much history a log screen can show. In effect, ALS extends Versa Analytics’ storage and processing capacity into a managed cloud tier without changing how administrators interact with their logs.
Frequently asked questions
What is the difference between Analytics, ALS, and Archive for a SASE tenant’s logs?
Analytics processes logs on the local Analytics cluster. Advanced Logging Service (ALS) processes and stores logs the same way, but in Versa’s cloud cluster instead. Archive also stores logs in the ALS cluster, but leaves them unprocessed – usable only for offline analysis, not live dashboards or reports.
How does a branch device send logs to ALS?
A branch VOS device uses a dedicated LEF profile that points to an ADC service on its SD-WAN Controller node. The Controller forwards the connection over an IPsec tunnel to the ALS cluster’s collectors, which pass the logs to the ALS engine for storage.
How is ALS licensed?
ALS is subscribed in multiples of 1 TB of storage per region, giving predictable, storage-based pricing instead of the compute and staffing costs of scaling an on-premises Analytics cluster to handle the same log volume. Regions can be sized independently as usage grows.
Do administrators need a separate interface to view ALS logs?
No. A connector configured between the on-premises Analytics cluster and the ALS cluster lets Analytics retrieve ALS-held data through its own APIs, so dashboards, reports, and log screens show ALS-hosted logs the same way they show locally stored ones, with no separate console to learn.
Which log types is ALS recommended for?
Versa recommends routing high-volume flow (session) log types to ALS, including access, antivirus, CGNAT, DHCP, DNS-filtering, file-filtering, traffic-monitoring, IDP, IP-filtering, packet-capture, SSL decryption, and URL-filtering logs – the categories most likely to overwhelm an on-premises cluster’s storage and processing capacity.
More on Versa Advanced Logging Service
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages for the platform whose Analytics and SASE tenant services ALS runs alongside. | How the SD-WAN fabric that generates the logs ALS processes is packaged and delivered, from the vendor. | Versa’s training portal: courses and labs covering Analytics, logging, and SASE tenant configuration. |
Related terms
If you’re reading about ALS, these are worth looking at next.
| Analytics Cluster | LEF Profile | Application Delivery Controller |
|---|---|---|
| The on-premises Versa Analytics nodes that ALS offloads high-volume logs from, and that retrieve ALS data back through a connector. | The VOS configuration object that steers a tenant’s log types to ALS, Analytics, or Archive by naming the collector to use. | The Controller-node load-balancing service that forwards branch LEF connections to the ALS cluster’s collectors. |