Diagnostic logs

The Cloudflare One Client (formerly WARP) provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.

To view client logs on desktop devices:

You can collect client diagnostic logs remotely from the Zero Trust dashboard by using Digital Experience Monitoring (DEX) remote captures.

Devices must be actively connected to the Internet for remote captures to run.

To capture data from a remote device:

1. In Cloudflare One ↗, go to DEX > Remote captures.
2. Select up to 10 devices that you want to run a capture on. Devices must be registered in your Zero Trust organization.
3. Configure the types of captures to run.

   • Packet captures (PCAP): Performs packet captures for traffic outside of the WARP tunnel (default network interface) and traffic inside of the WARP tunnel (virtual interface).

   • Device diagnostic logs: Generates a Cloudflare One Client diagnostic log of the past 96 hours. To include a routing test for all IPs and domains in your Split Tunnel configuration, select Test all routes.

4. Select Run diagnostics.

DEX will now send capture requests to the configured devices. If the Cloudflare One Client is disconnected, the capture will time out after 10 minutes.

1. In Cloudflare One ↗, go to DEX > Remote captures.
2. Find a successful capture.
3. Select the three-dot menu and select Download.

This will download a ZIP file to your local machine called <capture-id>.zip. DEX will store capture data according to our log retention policy.

The diagnostics analyzer highlights what Cloudflare determines to be the most important detection events in a warp-diag log. You can use the detection report to help parse your log files and identify the root cause of client issues. The diagnostics analyzer is only available for logs collected via the dashboard.

To access the diagnostics analyzer:

1. In Cloudflare One ↗, go to DEX > Remote captures.

2. Locate an existing warp-diag log from the list or select Run diagnostics to generate a new warp-diag log.

3. Select the three dots for the warp-diag log that you want to analyze, then select View Device Diag.

   The Overview tab will display an AI-generated summary of the results, a list of detection events, and basic device information.

   Explanation of the fields

   Field	Description
   Detection type	A common Cloudflare One Client issue that can appear in the diagnostic logs.
   Occurrences	Number of times an issue was detected in the logs.
   Severity level	Indicates the impact of the issue on Cloudflare One Client functionality. The severity levels are: Critical: Issue causes complete loss of functionality. Warning: Issue causes degraded functionality but core features should still work. No detection: Issue was not detected in the logs.
   Operating system	OS and OS version of the device.
   Cloudflare One Client version	Cloudflare One Client release version
   Profile ID	device profile UUID
   Service mode	Client mode
   Configuration name	Name of the Zero Trust organization that the Cloudflare One Client is connected to.
   Device ID	ID generated by the Cloudflare One Client.

4. Select a detection type for more information about the event and recommended next steps.

Cloudflare DEX will store the warp-diag log and its detection report per our log retention policy. To save a copy onto your local machine, download the log file and go to the JSON file tab to copy the report in JSON format.

The warp-debugging-info-<date>-<time>.zip archive contains the following files:

The warp-debugging-info folder may contain multiple versions of the same log, such as daemon.log, daemon.1.log, and daemon.2.log. Since logs can get very long, they are rotated either daily or when they exceed a certain size.

• <logfile>.log is the most current log. This is almost always the log you should be looking at, as it shows events that occurred on the day you ran the warp-diag command.
• <logfile>.1.log shows events from the previous day.
• <logfile>.2.log shows events from two days before.

Starting with version 2026.5.0, you can enable extra debug logging with the command warp-cli debug extra start. Extra debug logging times out after 10 minutes unless you manually stop it with warp-cli debug extra stop.

This enables a few more logging features:

• Packet captures (PCAPs) on all interfaces (on Windows, the original .etl file is preserved; other PCAP commands convert it to .pcap before removing it)
• QLog files for MASQUE tunnel connections
• DNS logs for service modes with DNS filtering
• One-shot connectivity checks (same information as connectivity.txt, collected when extra debug logging starts rather than when warp-diag runs)
• One-shot traceroutes to:
  • DNS resolver IPs
  • DNS resolver hostname
  • Device API endpoint IPs
  • Device API endpoint hostname
  • Tunnel edge connection IPs
• On Windows, if you are an administrator:
  • netsh trace ↗ with the Microsoft-Windows-TCPIP provider
  • WFP capture ↗

If extra debug logging is enabled, the command warp-cli debug extra reconnect forces the tunnel connection to restart. This can be useful for collecting log information if the tunnel connection fails.

Each client log file (such as connection_stats.log, dns_stats.log, daemon.log, boringtun.log, daemon_dns.log, dex.log and captive-portal.log) is limited by size and age:

• Maximum file size: 10 MB
• Maximum file age: 24 hours
• Maximum number of retained versions per log: 4 (for example, daemon.log, daemon.1.log, daemon.2.log, and daemon.3.log)

Log files may include data from up to 96 hours (four days) prior to when warp-diag was run, but only if log activity is minimal. In environments with high logging volume (for example, repeated errors), logs may rotate more frequently, and the captured window could be much shorter (only a few hours).

Always check the timestamps at the end of each log file to verify the time range covered by the diagnostic archive.

To view client logs on mobile devices:

The following log files are available for iOS, Android, and ChromeOS devices.

The warp-debugging-info-<date>-<time>.zip archive contains the following files: