What is Log Export Functionality?

Log Export Functionality (LEF) is the Versa Operating System (VOS) capability that forwards logs generated by features and services to a destination – a Versa Analytics log collector, a third-party syslog server, or a NetFlow collector – over TCP or UDP connections called LEF connections. A LEF profile determines which collector receives each feature’s or policy’s logs.

Key takeaways

• LEF forwards VOS logs to Analytics, syslog, or NetFlow collectors.
• LEF profiles map each feature or policy to its log collector destination.
• Logs travel to collectors over TCP or UDP links called LEF connections.
• A default LEF profile auto-exports alarm, SLA, and system logs.
• Each tenant configures its own separate templates, collectors, and profiles.

On this page: Why it matters · How it works · Types · LEF & Versa · FAQ

Why is LEF important?

Logs are worthless if they never leave the device that generated them. LEF gets VOS devices – branches, gateways, and Controller nodes – talking to the systems that turn raw events into visibility: Versa Analytics dashboards, a security team’s SIEM, or a NetFlow-based traffic analyzer. Without it, alarms, firewall decisions, DLP matches, and SLA violations stay local to the device and are never correlated, searched, or alerted on.

LEF also carries the operational signals that keep a fabric healthy. A default LEF profile automatically exports alarm, LTE, SD-WAN SLA, and system-load logs – the telemetry dashboards and NOC alerting depend on – with no per-feature configuration. And because LEF exports in industry-standard IPFIX or syslog, organizations already running a SIEM or NetFlow collector can plug Versa devices into existing pipelines instead of building new ones.

What is LEF?

Under the hood, LEF is a chain of configuration objects. A template sets the export format – IPFIX for Analytics and NetFlow destinations, syslog for third-party syslog servers. A collector names a destination – an IP address or FQDN, a port, and a transport (TCP or UDP) – plus queue limits governing how the device buffers logs when a connection is slow or down. Collectors can be grouped for high availability, with a primary collector and automatic failover to a backup.

A LEF profile ties a template and a collector (or group) together and is applied to a feature, service, traffic-monitoring rule, or the tenant’s logging control configuration; one profile per tenant can be the default, auto-forwarding critical logs without per-feature setup. Logs travel in syslog format, tagged with a syslog identifier naming the log type (accessLog, alarmLog, dlpLog, and so on), over a TCP or UDP session called a LEF connection – typically routed through an Application Delivery Controller.

Types of LEF exports

LEF sends logs to three kinds of destination, and the format changes with each. Analytics export uses IPFIX to send log data to Versa Analytics log collector nodes, populating the Analytics dashboards and log screens in Director – the most common case. Syslog export sends the same events, in standard syslog format, to a third-party syslog server or SIEM, letting a security team fold VOS logs into tooling it already runs. NetFlow export also uses IPFIX, formatted to interoperate with third-party flow collectors such as SolarWinds and Cisco Stealthwatch; because IPFIX fields are not fully standardized across vendors, VOS devices support both a beginning/end-of-flow template and a periodic interim-record template.

A fourth distinction cuts across all three: how the LEF profile is associated with the traffic it captures – attached to an individual feature or service, a traffic-monitoring policy rule, the tenant’s logging control configuration, or set as the default.

LEF & Versa

LEF is configured per VOS device under Objects & Connectors > Connectors > Reporting > Logging Export Function in Director. Configure Log Export Functionality covers building the template-collector-profile chain end to end; Apply Log Export Functionality is the companion reference for wiring a LEF profile into individual features – firewall, DLP, DNS filtering, ATP, CGNAT, and dozens more.

Not every log type is exportable everywhere: Digital Experience Monitoring data, for instance, can only be sent to Analytics nodes, never to third-party syslog or NetFlow systems, because its format is proprietary. When LEF connections misbehave, Troubleshoot Log Export Functionality Issues walks through verifying the configuration, checking export statistics, and tracing the connection from device to Analytics node, often through an Application Delivery Controller.

Frequently asked questions

What is the difference between a LEF profile and a LEF collector?

A collector defines a destination – IP or FQDN, port, and transport – and how logs queue there. A LEF profile ties a template and a collector together and is what you apply to a feature, policy, or tenant; the collector alone does nothing until a profile references it.

Can LEF export logs without an Analytics cluster?

Yes. LEF can send syslog-formatted logs directly to a third-party syslog server, or IPFIX-formatted flow logs to a NetFlow collector such as SolarWinds, entirely independent of Versa Analytics – Analytics is simply one destination type among several, not a requirement.

What happens to logs when a LEF connection goes down?

The VOS device queues them by priority – high, medium, low – for a configurable hold interval, then drops them if the connection has not recovered. High-priority logs, such as alarms, get a longer default hold interval than low-priority traffic logs.

Why does each tenant need its own LEF profile?

Multitenancy isolates configuration end to end: each tenant on a VOS device maintains its own entirely separate set of LEF templates, collectors, collector groups, and profiles, so no organization’s log stream or export destinations ever mix with a neighboring tenant’s.

How do I know if LEF is actually exporting logs?

Display LEF export statistics from the VOS device CLI, wait a few minutes, and reissue the command – incrementing counts per log category confirm active export. A stalled counter usually points to a misconfigured feature rather than a broken connection.

More on Log Export Functionality

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about LEF, these are worth looking at next.