Skip to content
Cloudflare Docs

WARP diagnostic logs

The WARP client provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.

Chapters

macOS/Windows/Linux

Collect logs via the CLI

To view WARP logs on desktop devices:

  1. Open a Terminal window.
  2. Run the warp-diag tool:
    Terminal window
    warp-diag

This will place a warp-debugging-info-<date>-<time>.zip on your desktop.

Collect logs via the dashboard

Feature availability
WARP modesZero Trust plans ↗
  • Gateway with WARP
  • Secure Web Gateway without DNS Filtering
All plans
SystemAvailabilityMinimum WARP version
Windows✅2024.12.492.0
macOS✅2024.12.492.0
Linux✅2024.12.492.0
iOS❌
Android❌
ChromeOS❌

You can collect WARP diagnostic logs remotely from the Zero Trust dashboard by using Digital Experience Monitoring (DEX) remote captures.

Devices must be actively connected to the Internet for remote captures to run.

To capture data from a remote device:

  1. In Zero Trust ↗, go to DEX > Remote captures.
  2. Select up to 10 devices that you want to run a capture on. Devices must be registered in your Zero Trust organization.
  3. Configure the types of captures to run.
    • Packet captures (PCAP): Performs packet captures for traffic outside of the WARP tunnel (default network interface) and traffic inside of the WARP tunnel (WARP virtual interface).
    • WARP Diagnostics Logs: Generates a WARP diagnostic log of the past 96 hours. To include a routing test for all IPs and domains in your Split Tunnel configuration, select Test all routes.
  4. Select Run diagnostics.

DEX will now send capture requests to the configured devices. If the WARP client is disconnected, the capture will time out after 10 minutes.

Download remote captures

  1. In Zero Trust ↗, go to DEX > Remote captures.
  2. Find a successful capture.
  3. Select the three-dot menu and select Download.

This will download a ZIP file to your local machine called <capture-id>.zip. DEX will store capture data according to our log retention policy.

View WARP diagnostics summary (beta)

The WARP diagnostics summary highlights what Cloudflare determines to be the most important detection events in a warp-diag log. You can use the WARP diagnostic summary to help analyze your log files and identify the root cause of client issues. WARP diagnostic summaries are only available for logs collected via the dashboard.

To access your WARP diagnostic summary:

  1. In Zero Trust ↗, go to DEX > Remote captures.

  2. Locate an existing warp-diag log from the list or select Run diagnostics to generate a new warp-diag log.

  3. Select the three dots for the warp-diag log that you want to analyze, then select View WARP Diag.

    The Overview tab will display an AI-generated summary of the results, a list of detection events, and basic device information.

    Explanation of the fields
    FieldDescription
    Detection typeA common WARP issue that can appear in the diagnostic logs.
    OccurencesNumber of times an issue was detected in the logs.
    Severity levelIndicates the impact of the issue on WARP client functionality. The severity levels are:
    • Critical: Issue causes complete loss of functionality.
    • Warning: Issue causes degraded functionality but core features should still work.
    • No detection: Issue was not detected in the logs.
    Operating systemOS and OS version of the device.
    WARP versionWARP release version
    Profile IDWARP device profile UUID
    Service modeWARP mode
    Configuration nameName of the Zero Trust organization that WARP is connected to.
    Device IDID generated by the WARP client.

  4. Select a detection type for more information about the event and recommended next steps.

Cloudflare will store the warp-diag log and its summary per our log retention policy. To save a copy onto your local machine, download the log file and go to the JSON file tab to copy the summary in JSON format.

warp-diag logs

The warp-debugging-info-<date>-<time>.zip archive contains the following files:

File nameDescription
.qlogQLog files used to debug MASQUE connection issues.
.pcapPacket capture (PCAP) files that were manually generated using warp-cli debug pcap commands.
alternate-networks-check.txtConnectivity status for each managed network.
boringtun.logLog for the WARP tunnel that serves traffic from the device to Cloudflare's global network.
bound-dns-ports.txtActive processes on port 53.
captive-portal-hotspot-detect.txtHTTP response of captive.apple.com
connectivity.txtDNS resolution and HTTP trace requests to validate a successful connection. Can be used to determine whether traffic is routing through the WARP tunnel.
daemon_dns.logContains detailed DNS logs if Log DNS queries is enabled in the WARP client.
daemon.logDetailed log of all actions performed by the WARP client, including all communication between the device and Cloudflare's global network. Note: This is the most useful debug log.
date.txtDate and time (UTC) when you ran the warp-diag command.
dex.logLogs related to DEX test execution.
dhcp-lease-plists.txtDHCP lease information from /var/db/dhcpclient/leases/ for each interface that has a DHCP lease.
dhcp-lease.txtDHCP lease information from ipconfig (macOS) or nmcli (Linux).
dig.txtDNS lookup query output for cloudflare.com and apple.com.
dns_stats.logStatistics on the DNS queries received and resolved by WARP, generated every two minutes.
dns-check.txtVerifies that the WARP DNS servers are set as system default. For operating modes where DNS filtering is enabled, this file contains the IPs of the local WARP DNS proxy (127.0.2.2:0, 127.0.2.3:0, [fd01:db8:1111::2]:0, and [fd01:db8:1111::3]:0).
dynamic.logReserved for use by Cloudflare Support.
etc-hosts.txtStatic DNS config of device.
firewall-pfctl-all.txtPacket filter (pf) firewall configuration (macOS only).
firewall-rules.txtThe system firewall rules configured by WARP.
gui-launcher.logmacOS console log showing application launch.
gui-log.logLog file for the GUI app that users interact with.
hostname.txtName of the device.
ifconfig.txt
ipconfig.txt		IP configuration of each network interface.
installed_applications.txtList of installed applications.
installed_cert.pemRoot certificate installed on the system.
installer.log
msi-installer.log		MSI or PKG installation log.
InstallHistory.plist
macos_installer.log		macOS software installation logs.
ipc.logLogs IPC communication between the GUI and daemon. Useful for situations where the GUI crashes or is unable to communicate with the daemon.
kernel-modules.txtList of loaded kernel modules (macOS and Linux) or drivers (Windows).
launchd-dumpstate.txtCurrent state of the macOS launchd system including the loaded jobs, their status, and dependencies.
local_policy.redacted.txt
mdm.plist
mdm.xml		Managed deployment parameters on the device.
lsb-release.txtOutput from the lsb_release command (Linux only).
netstat.txt
routetable.txt		Routing table used by the device.
netstat-v6.txtIPv6 routing table (Linux only).
platform.txtOperating system of the device.
ps.txt
processes.txt		List of all active processes on the device when warp-diag was run.
resolv.confThe contents of the /etc/resolv.conf file on Mac/Linux, where system DNS servers are configured.
route.txtOutput from the ip route get command, used to verify that network traffic is going over the correct interface. You can optionally use the warp-diag --enable-all-routes flag to include tests for all IPs and domains in your Split Tunnel configuration.
scutil-dns.txtDNS configuration on macOS/Linux (available in ipconfig.txt on Windows).
scutil-networkinfo.txtIPv4 and IPv6 network interface configuration on macOS (available in interfaces-config.txt on Windows).
scutil-proxy.txtProxy configuration on macOS/Linux (available in ipconfig.txt on Windows).
snapshots-collection.logLogs generated when collecting snapshots/*.log. Used to debug why WARP failed to collect a snapshot.
snapshots/*.logDiagnostics generated when an error occurs.
stats.logUptime and throughput stats for the WARP tunnel, generated every two minutes.
sw-vers.txtOperating system of the device.
sysinfo.jsonCPU and memory usage when warp-diag was run. This information is useful for determining whether slow speeds are due to heavy system load.
system-extension-diagnostics.txtStatus and health of loaded system extensions (macOS only).
systeminfo.txt
system-profile.txt		System software overview.
System.evtxWindows system event log.
taskdump.logIf the daemon hangs, this file will contain a dump of the currently running processes. This is helpful in debugging hangs, deadlocks, and tasks.
timezone.txtLocal timezone of the device specified as a UTC offset.
traceroute.txtTraceroute to the WARP ingress IPs showing the path from the device to Cloudflare's global network.
uname.txtLinux-only system information including kernel version.
v4interfaces.txt
v4subinterfaces.txt
v6interfaces.txt
v6subinterfaces.txt		IPv4 and IPv6 network configuration on Windows.
version.txtWARP client version installed on the device.
warp-account.txtWARP client device enrollment information.
warp-bus-metrics.txtMetrics for the internal message bus framework used by the WARP client.
warp-device-posture.txtCurrent device posture status.
warp-dex-data.txtCurrently configured DEX tests and their most recent statuses.
warp-dns-fallbacks.txtList of default DNS fallbacks used by the WARP DNS proxy.
warp-dns-lock.jsonDefault DNS providers and network interface information.
warp-dns-stats.txtSummary of recent DNS queries on the device since dns-stats.log was generated.
warp-network.txtNetwork settings on the device detected by WARP.
warp-settings.txtWARP client settings applied to the device.
warp-stats.txtUptime and throughput of the WARP tunnel since stats.log was generated.
warp-status.txtStatus of WARP switch (Connected or Disconnected).
wdutil-info.txtWi-Fi diagnostics (macOS only).
xpc-launchd.logMost recent log file for the launchd process on macOS.

Multiple versions of the same log

The warp-debugging-info folder may contain multiple versions of the same log, such as daemon.log, daemon.1.log, and daemon.2.log. Since logs can get very long, they are rotated either daily or when they exceed a certain size.

  • <logfile>.log is the most current log. This is almost always the log you should be looking at, as it shows events that occurred on the day you ran the warp-diag command.
  • <logfile>.1.log shows events from the previous day.
  • <logfile>.2.log shows events from two days before.

Log retention window

Each WARP log file (such as connection_stats.log, dns_stats.log, daemon.log, boringtun.log, daemon_dns.log, dex.log and captive-portal.log) is limited by size and age:

  • Maximum file size: 10 MB
  • Maximum file age: 24 hours
  • Maximum number of retained versions per log: 4 (for example, daemon.log, daemon.1.log, daemon.2.log, and daemon.3.log)

Log files may include data from up to 96 hours (four days) prior to when warp-diag was run, but only if log activity is minimal. In environments with high logging volume (for example, repeated errors), logs may rotate more frequently, and the captured window could be much shorter (only a few hours).

Always check the timestamps at the end of each log file to verify the time range covered by the diagnostic archive.

iOS/Android/ChromeOS

Collect logs

To view WARP logs on mobile devices:

  1. Open the 1.1.1.1 app.
  2. Go to Settings > Advanced > Diagnostics.
  3. Scroll down to Debug logs and choose from the available logs.

Mobile app logs

Mobile app logs contain a subset of the information available for desktop clients. To learn more about these files, refer to their equivalent warp-diag logs.

iOS

NameEquivalent warp-diag log
DNS logsdaemon_dns.log
Console logs > Extension logsdaemon.log
Console logs > Application logsconnectivity.txt and gui-log.log
Routing tablenetstat.txt

Android/ChromeOS

NameEquivalent warp-diag log
DNS logsdaemon_dns.log
Console logsconnectivity.txt, netstat.log, and gui-log.log
Native logsdaemon.log