Diagnostic logs

The WARP client provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.

macOS/Windows/Linux

Retrieve logs

To view WARP logs on desktop devices:

macOS

1. Open a Terminal window.
2. Run the warp-diag tool:

   warp-diag

This will place a warp-debugging-info-<date>-<time>.zip on your Desktop.

Windows

1. Open a Command Prompt or PowerShell window.
2. Run the warp-diag tool:

   C:\Users\JohnDoe>warp-diag

This will place a warp-debugging-info-<date>-<time>.zip on your Desktop.

Linux

1. Open a Terminal window.
2. Run the warp-diag tool:

   warp-diag

This will place a warp-debugging-info-<date>-<time>.zip in the same folder you ran the command from.

Note

You can also use Digital Experience Monitoring to run warp-diag commands on remote devices. For more information, refer to Remote captures.

warp-diag logs

The warp-debugging-info-<date>-<time>.zip archive contains the following files:

File name	Description
.qlog	QLog files used to debug MASQUE connection issues.
.pcap	Packet capture (PCAP) files that were manually generated using warp-cli debug pcap commands.
alternate-networks-check.txt	Connectivity status for each managed network.
boringtun.log	Log for the WARP tunnel that serves traffic from the device to Cloudflare's global network.
bound-dns-ports.txt	Active processes on port 53.
captive-portal-hotspot-detect.txt	HTTP response of captive.apple.com
connectivity.txt	DNS resolution and HTTP trace requests to validate a successful connection. Can be used to determine whether traffic is routing through the WARP tunnel.
daemon_dns.log	Contains detailed DNS logs if Log DNS queries is enabled in the WARP client.
daemon.log	Detailed log of all actions performed by the WARP client, including all communication between the device and Cloudflare's global network. Note: This is the most useful debug log.
date.txt	Date and time (UTC) when you ran the warp-diag command.
dex.log	Logs related to DEX test execution.
dhcp-lease-plists.txt	DHCP lease information from /var/db/dhcpclient/leases/ for each interface that has a DHCP lease.
dhcp-lease.txt	DHCP lease information from ipconfig (macOS) or nmcli (Linux).
dig.txt	DNS lookup query output for cloudflare.com and apple.com.
dns_stats.log	Statistics on the DNS queries received and resolved by WARP, generated every two minutes.
dns-check.txt	Verifies that the WARP DNS servers are set as system default. For operating modes where DNS filtering is enabled, this file contains the IPs of the local WARP DNS proxy (127.0.2.2:0, 127.0.2.3:0, [fd01:db8:1111::2]:0, and [fd01:db8:1111::3]:0).
dynamic.log	Reserved for use by Cloudflare Support.
etc-hosts.txt	Static DNS config of device.
firewall-pfctl-all.txt	Packet filter (pf) firewall configuration (macOS only).
firewall-rules.txt	The system firewall rules configured by WARP.
gui-launcher.log	macOS console log showing application launch.
gui-log.log	Log file for the GUI app that users interact with.
hostname.txt	Name of the device.
ifconfig.txt ipconfig.txt	IP configuration of each network interface.
installed_applications.txt	List of installed applications.
installed_cert.pem	Root certificate installed on the system.
installer.log msi-installer.log	MSI or PKG installation log.
InstallHistory.plist macos_installer.log	macOS software installation logs.
ipc.log	Logs IPC communication between the GUI and daemon. Useful for situations where the GUI crashes or is unable to communicate with the daemon.
kernel-modules.txt	List of loaded kernel modules (macOS and Linux) or drivers (Windows).
launchd-dumpstate.txt	Current state of the macOS launchd system including the loaded jobs, their status, and dependencies.
local_policy.redacted.txt mdm.plist mdm.xml	Managed deployment parameters on the device.
lsb-release.txt	Output from the lsb_release command (Linux only).
netstat.txt routetable.txt	Routing table used by the device.
netstat-v6.txt	IPv6 routing table (Linux only).
platform.txt	Operating system of the device.
ps.txt processes.txt	List of all active processes on the device when warp-diag was run.
resolv.conf	The contents of the /etc/resolv.conf file on Mac/Linux, where system DNS servers are configured.
route.txt	Output from the ip route get command, used to verify that network traffic is going over the correct interface. You can optionally use the warp-diag --enable-all-routes flag to include tests for all IPs and domains in your Split Tunnel configuration.
scutil-dns.txt	DNS configuration on macOS/Linux (available in ipconfig.txt on Windows).
scutil-networkinfo.txt	IPv4 and IPv6 network interface configuration on macOS (available in interfaces-config.txt on Windows).
scutil-proxy.txt	Proxy configuration on macOS/Linux (available in ipconfig.txt on Windows).
snapshots-collection.log	Logs generated when collecting snapshots/*.log. Used to debug why WARP failed to collect a snapshot.
snapshots/*.log	Diagnostics generated when an error occurs.
stats.log	Uptime and throughput stats for the WARP tunnel, generated every two minutes.
sw-vers.txt	Operating system of the device.
sysinfo.json	CPU and memory usage when warp-diag was run. This information is useful for determining whether slow speeds are due to heavy system load.
system-extension-diagnostics.txt	Status and health of loaded system extensions (macOS only).
systeminfo.txt system-profile.txt	System software overview.
System.evtx	Windows system event log.
taskdump.log	If the daemon hangs, this file will contain a dump of the currently running processes. This is helpful in debugging hangs, deadlocks, and tasks.
timezone.txt	Local timezone of the device specified as a UTC offset.
traceroute.txt	Traceroute to the WARP ingress IPs showing the path from the device to Cloudflare's global network.
uname.txt	Linux-only system information including kernel version.
v4interfaces.txt v4subinterfaces.txt v6interfaces.txt v6subinterfaces.txt	IPv4 and IPv6 network configuration on Windows.
version.txt	WARP client version installed on the device.
warp-account.txt	WARP client device enrollment information.
warp-bus-metrics.txt	Metrics for the internal message bus framework used by the WARP client.
warp-device-posture.txt	Current device posture status.
warp-dex-data.txt	Currently configured DEX tests and their most recent statuses.
warp-dns-fallbacks.txt	List of default DNS fallbacks used by the WARP DNS proxy.
warp-dns-lock.json	Default DNS providers and network interface information.
warp-dns-stats.txt	Summary of recent DNS queries on the device since dns-stats.log was generated.
warp-network.txt	Network settings on the device detected by WARP.
warp-settings.txt	WARP client settings applied to the device.
warp-stats.txt	Uptime and throughput of the WARP tunnel since stats.log was generated.
warp-status.txt	Status of WARP switch (Connected or Disconnected).
wdutil-info.txt	Wi-Fi diagnostics (macOS only).
xpc-launchd.log	Most recent log file for the launchd process on macOS.

Multiple versions of the same log

The warp-debugging-info folder may contain multiple versions of the same log, such as daemon.log, daemon.1.log, and daemon.2.log. Since logs can get very long, they are rotated either daily or when they exceed a certain size.

• <logfile>.log is the most current log. This is almost always the log you should be looking at, as it shows events that occurred on the day you ran the warp-diag command.
• <logfile>.1.log shows events from the previous day.
• <logfile>.2.log shows events from two days before.

Note

In timestamped logs such as daemon.log, the most recent events will appear at the end of the file.

iOS/Android/ChromeOS

Retrieve logs

To view WARP logs on mobile devices:

1. Open the 1.1.1.1 app.
2. Go to Settings > Advanced > Diagnostics.
3. Scroll down to Debug logs and choose from the available logs.

Mobile app logs

Mobile app logs contain a subset of the information available for desktop clients. To learn more about these files, refer to their equivalent warp-diag logs.

iOS

Name	Equivalent warp-diag log
DNS logs	daemon_dns.log
Console logs > Extension logs	daemon.log
Console logs > Application logs	connectivity.txt and gui-log.log
Routing table	netstat.txt

Android/ChromeOS

Name	Equivalent warp-diag log
DNS logs	daemon_dns.log
Console logs	connectivity.txt, netstat.log, and gui-log.log
Native logs	daemon.log

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!