Tunnel logs record all activity between a cloudflared instance and Cloudflare's global network, as well as all activity between cloudflared and your origin server. These logs allow you to investigate connectivity or performance issues with a Cloudflare Tunnel. You can configure your server to store persistent logs, or you can stream real-time logs from any client machine.
If you have access to the origin server, you can use the --loglevel flag to enable logging when you start the tunnel. By default, cloudflared prints logs to stdout and does not store logs on the server. You can optionally use the --logfile flag to write your logs to a file.
To enable logs, run the tunnel using the --loglevel info and --logfile <PATH> flags. For example,
cloudflared tunnel --loglevel info --logfile cloudflared.log run <UUID>You can view real-time logs for a Cloudflare Tunnel via the dashboard or from any machine that has cloudflared installed. With remote log streams, you do not need to SSH into the server that is running the tunnel. To get remote logs, the tunnel must be active and able to receive requests.
To stream tunnel logs from the dashboard:
-
In the Cloudflare dashboard, go to Networking > Tunnels and select your tunnel.
Go to Tunnels ↗ -
Go to the Live logs tab.
-
Select Live to start streaming.
If you are running multiple cloudflared instances for the same tunnel (also known as replicas), logs from all connected replicas are streamed automatically and grouped by hostname, making it easy to identify which host machine produced each log entry.
To filter the stream to specific replicas, select the Filter icon and expand the Replicas section. You can also filter by Log Level and Event Type.
The cloudflared daemon can stream logs from any tunnel in your account to the local command line. cloudflared must be installed on both your local machine and the origin server.
The cloudflared daemon can stream logs from any tunnel in your account to the local command line. cloudflared must be installed on both your local machine and the origin server.
-
On your local machine, authenticate
cloudflaredto your Cloudflare account:cloudflared tunnel login -
Run
cloudflared tailfor a specific tunnel:cloudflared tail <UUID>For a more structured view of the JSON message, you can pipe the output to tools like jq ↗:
cloudflared tail --output=json <UUID> | jq .
You can filter logs by event type (--event), event level (--level), or sampling rate (-sampling) to reduce the volume of logs streamed from the origin. This helps mitigate the performance impact on the origin, especially when the origin is normally under high load. For example:
cloudflared tail --level debug <UUID>| Flag | Description | Allowed values | Default value |
|---|---|---|---|
--event |
Filter by the type of event / request. | cloudflared, http, tcp, udp |
All events |
--level |
Return logs at this level and above. Works independently of the --loglevel setting on the server. |
debug, info, warn, error, fatal |
debug |
--sampling |
Sample a fraction of the total logs. | Number from 0.0 to 1.0 |
1.0 |
If you are running multiple cloudflared instances for the same tunnel (also known as replicas), you must specify an individual instance to stream logs from:
-
In the Cloudflare dashboard, go to Networking > Tunnels and select your tunnel.
Go to Tunnels ↗ -
Find the Connector ID for the
cloudflaredinstance you want to view. -
Specify the Connector ID in
cloudflared tail:cloudflared tail --connector-id <CONNECTOR ID> <UUID>
- The logging session will only be held open for one hour. All logging systems introduce some level of performance overhead, and this limit helps prevent long term impact to your tunnel's end-to-end latencies.
- When streaming logs for a high throughput tunnel, Cloudflare intentionally prioritizes service stability over log delivery. To reduce the number of dropped logs, try requesting fewer logs. To ensure that you are seeing all logs, view logs on the server instead of streaming the logs remotely.