Gateway activity logs

Gateway activity logs record the DNS queries, Network packets, and HTTP requests inspected by Gateway. You can also download encrypted SSH command logs for sessions proxied by Gateway.

Enterprise users can generate more detailed logs with Logpush.

• Manage PII

Private source IP substitution

Gateway logs show the public IP address in the Source IP field. Private IP addresses are translated to public addresses via network address translation (NAT). To see the user's original private IP, refer to the Source internal IP field in the DNS, Network, or HTTP log details below.

View Gateway activity logs

To view Gateway activity logs:

1. In the Cloudflare dashboard ↗, go to Zero Trust > Insights > Logs.

2. Choose a type of Gateway log:

   • DNS query logs
   • Network logs
   • HTTP request logs

   Log viewer (beta)

   Gateway logs use an updated log viewer with enhanced filtering capabilities. To switch to the classic view, select Return to old logs.

3. (Optional) Filter the logs that display in the log viewer. You can filter logs by their timestamp and event details (such as host, URL, user email, policy action, and more).

   Tip

   Querying for fewer fields improves log loading performance.

4. Select an individual timestamp to investigate the event in more detail.

Selective logging

By default, Gateway logs all events, including DNS queries and HTTP requests that are allowed and not a risk. You can choose to disable logging entirely or only log blocked requests.

To customize what Gateway logs:

1. In the Cloudflare dashboard ↗, go to Zero Trust > Traffic policies > Traffic settings.

2. Under Traffic logging > Log traffic activity, choose your preference for DNS, Network, and HTTP logs.

These settings only apply to logs displayed in Cloudflare One. Logpush data is unaffected.

DNS logs

Explanation of the fields

Basic information

Field	Description
Query name	Name of the domain that was queried.
Query ID	UUID of the query assigned by Cloudflare.
Email	Email address of the user who registered the Cloudflare One Client where traffic originated from. If a non-identity on-ramp (such as a proxy endpoint) or machine-level authentication (such as a service token) was used, this value will be non_identity@<team-domain>.cloudflareaccess.com.
Action	The Action Gateway applied to the query (such as Allow or Block).
Time	Date and time of the DNS query.
Resolver decision	The reason why Gateway applied a particular Action to the request. Refer to the list of resolver decisions.
Resolved IPs	Resolved IP addresses in the response.
CNAMEs	CNAME records in the query.

Configuration information

Field	Description
DNS location	User-configured location from where the DNS query was made.
Policy name	Name of the matched policy.
Policy ID	ID of the matched policy.
Policy description	Description of the matched policy.
DoH subdomain	DoH subdomain of the DNS location.
Protocol	Protocol that was used to make the DNS query (such as https).

Identities

Field	Description
Email	Email address of the user who registered the Cloudflare One Client where traffic originated from.
User ID	UUID of the user. Each unique email address in your organization will have a UUID associated with it.
Registration ID	UUID of the user's Cloudflare One Client registration. A unique registration ID is generated each time a device is registered for a particular email. The same physical device may have multiple registration IDs.
Device name	Display name of the device returned by the operating system to the Cloudflare One Client. Typically this is the hostname of a device. Not all devices will have a device name. Device names are not guaranteed to be unique.
Device ID	UUID of the device connected with the Cloudflare One Client. Each physical device in your organization will have a UUID.
Last authenticated	Date and time the user last authenticated their Zero Trust session.

DNS query details

Field	Description
Query ID	UUID of the query assigned by Cloudflare.
Query type	Type of DNS query ↗.
Initial query domain categories	Content categories that the domain belongs to.
Matched categories	Name of the Gateway policy category that match the domain.
Matched indicator feed names	Name of the indicator feeds that matched a Gateway policy.
Query indicator feed names	Name of the indicator feeds that a matched domain or IP belongs to.
Resolved continent IP geolocation	Continent code of the resolved IP address.
Resolved country IP geolocation	Country code of the resolved IP address.
DoT subdomain	DoT subdomain of the DNS location.
Source IP	Public source IP address of the DNS query.
Source IP continent	Continent code of the source IP address.
Source IP country	Country code of the source IP address.
Source internal IP	Private IP address assigned by the user's local network.
Application name	Name of the application that matched the domain.
Resolver IP	Public IP address of the DNS resolver.
Port	Port that was used to make the DNS query.
Location ID	ID of the DNS location where the query originated.
Scheduling - Time zone	Time zone of the DNS query source.
Scheduling - Time zone inferred method	Method used to determine the DNS query source's time zone.

DNS response details

Field	Description
Resolved CNAME categories	Content categories associated with the resolved CNAME records in the response.
Resolved IP categories	Content categories associated with the resolved IPs in the response.
Resolved IPs	Resolved IPs in the response.
Authoritative nameserver IP	IP address of the authoritative nameserver answering the DNS query.
EDE errors	Extended DNS error codes ↗ in the response.

Custom resolver

Field	Description
Address	Address of your custom resolver.
Policy	Name of the matched resolver policy.
Response	Status of the custom resolver response.
Time (in milliseconds)	Duration of time it took for the custom resolver to respond.

Resolver decisions

Name	Value	Description
blockedByCategory	3	Domain or hostname matched a category in a Block policy.
allowedOnNoLocation	4	Allowed because query did not match a Gateway DNS location.
allowedOnNoPolicyMatch	5	Allowed because query did not match a policy.
blockedAlwaysCategory	6	Domain or hostname is always blocked by Cloudflare.
overrideForSafeSearch	7	Response was overridden by a Safe Search policy.
overrideApplied	8	Response was overridden by an Override policy.
blockedRule	9	IP address in the response matched a Block policy.
allowedRule	10	IP address in the response matched an Allow policy.

Network logs

Failed connection logs

Gateway only logs TCP connections that were successfully established. If a connection is not complete (such as a TCP SYN with no SYN ACK), Gateway does not record it in network logs.

To log failed connections, use network session logs. These logs are available for Enterprise users via Logpush or GraphQL.

Explanation of the fields

Basic information

Field	Description
Source IP	IP address of the user sending the packet.
Source Internal IP	Private IP address assigned by the user's local network.
Destination IP	IP address of the packet's target.
Action	The Gateway Action taken based on the first rule that matched (such as Allow or Block).
Session ID	ID of the unique session.
Time	Date and time of the session.

Matched policies

Field	Description
DNS location	User-configured location from where the DNS query was made.
Policy name	Name of the matched policy.
Policy ID	ID of the policy enforcing the decision Gateway made.
Policy description	Description of the matched policy.

Identities

Field	Description
Email	Email address of the user sending the packet. This is generated by the Cloudflare One Client.
User ID	ID of the user sending the packet. This is generated by the Cloudflare One Client.
Registration ID	ID of the user's device registration. This is generated by the Cloudflare One Client.
Device name	Name of the device that sent the packet.
Device ID	ID of the physical device that sent the packet. This is generated by the Cloudflare One Client.
Last authenticated	Date and time the user last authenticated with Zero Trust.

Network query details

Field	Description
Source IP	IP address of the user sending the packet.
Source port	Source port number for the packet.
Source country	Country code for the packet source.
Source IP continent	Continent code of the source IP address.
Source IP country	Country code of the source IP address.
Destination IP	IP address of the packet's target.
Destination port	Destination port number for the packet.
Destination IP continent	Continent code of the IP address for the packet's destination.
Destination IP country	Country code of the IP address for the packet's destination.
Transport protocol	Protocol over which the packet was sent.
Detected Protocol	The detected network protocol.
SNI	Host whose Server Name Indication (SNI) header Gateway will filter traffic against.
Virtual Network	Virtual network that the client is connected to.
Category details	Category or categories associated with the packet.
Proxy endpoint	PAC file proxy endpoint Gateway forwarded traffic to, if applicable.
Application ID	ID of the application that matched the domain.
Application name	Name of the application that matched the domain.

HTTP logs

Note

Gateway does not log HTTP bodies. The exception is error requests: when an HTTP request results in an error, Gateway logs the first 512 bytes of the request for 30 days for internal troubleshooting.

Explanation of the fields

Basic information

Field	Description
Host	Hostname in the HTTP header for the HTTP request. Gateway will log the SNI in this field if it responded to the request with a Do Not Inspect action. If Gateway does not receive the SNI, this field will be empty.
Email	Email address of the user who made the HTTP request. This is generated by the Cloudflare One Client.
Action	The Gateway Action taken based on the first rule that matched (such as Allow or Block).
Request ID	Unique ID of the request.
Time	Date and time of the HTTP request.
Source internal IP	Private IP address assigned by the user's local network.
User agent	User agent header sent in the request by the originating device.
Policy details	Policy corresponding to the decision Gateway made based on the traffic criteria of the request.
DLP profiles	Name of the matched DLP profile.
DLP profile entries	Name of the matched entry within the DLP profile.
Uploaded/downloaded file	Information about the file transferred in the request found by enhanced file detection. Details include: File name File type File size File hash (for Allowed requests only) Content type Direction (Upload/Download) Action (Block/Allow)

Matched policies

Field	Description
DNS location	User-configured location from where the DNS query was made.
Policy name	Name of the matched policy.
Policy ID	ID of the matched policy.
Policy description	Description of the matched policy.
Matched category ID	ID of the category matched in the policy.
Matched category name	Name of the category matched in the policy.

Identities

Field	Description
Email	Email address of the user who made the HTTP request. This is generated by the Cloudflare One Client.
User ID	ID of the user who made the request. This is generated by the Cloudflare One Client.
Registration ID	ID of the user's device registration. This is generated by the Cloudflare One Client.
Device name	Name of the device that made the request.
Device ID	ID of the physical device that made the request. This is generated by the Cloudflare One Client on the device that created the request.
Last authenticated	Date and time the user last authenticated with Zero Trust.

HTTP query details

Field	Description
HTTP Version	HTTP version of the origin that Gateway connected to on behalf of the user.
HTTP Method	HTTP method used for the request (such as GET or POST).
HTTP Status Code	HTTP status code returned in the response.
URL	Full URL of the HTTP request.
Referer	Referer request header containing the address of the page making the request.
Source IP	Public source IP address of the HTTP request.
Source Port	Port that was used to make the HTTP request.
Source IP continent	Continent code of the HTTP request.
Source IP country	Country code of the HTTP request.
Destination IP	Public IP address of the destination requested.
Destination Port	Port of the destination requested.
Destination IP continent	Continent code of the destination requested.
Destination IP country	Country code of the destination requested.
Blocked file reason	Reason why the file was blocked if a file transfer occurred or was attempted.
Category details	Detailed information on the category the blocked file belongs to.
Application ID	ID of the application that matched the domain.
Application name	Name of the application that matched the domain.
Categories	Content categories that the domain belongs to.
Proxy endpoint	PAC file proxy endpoint Gateway forwarded traffic to, if applicable.
Virtual Network	Virtual network that the client is connected to.
Sandbox scanned	Status of the file quarantine.

File detection details

Field	Description
Name	Name of the detected file.
Type	File type of the detected file.
Size	Size of the detected file.
Hash	Hash of the detected file, generated by DLP.
Content type	MIME type of the detected file.
Direction	Upload or download direction of the detected file.
Action	The Action Gateway applied to the request.

Enhanced file detection

Enhanced file detection is an optional feature that extracts more file information from HTTP traffic. When turned on, Gateway reads file information from the HTTP body rather than the HTTP headers, providing greater accuracy and reliability. This feature may have a minor impact on performance for file-heavy organizations.

To turn on enhanced file detection:

1. In the Cloudflare dashboard ↗, go to Zero Trust > Traffic policies > Traffic settings.
2. In Proxy and inspection settings, turn on Inspect HTTPS requests with TLS decryption.
3. In Policy settings, turn on Allow enhanced file detection.

Isolate requests

When a user creates an isolation policy, Gateway logs isolation-related requests in two stages:

1. Initial request — The request that triggers isolation is logged with an Isolate action. Because this request is not yet isolated, the is_isolated field returns false.
2. Subsequent requests — After Zero Trust returns the result to the user in an isolated browser, Gateway logs all subsequent requests in the isolated browser with the action (such as Allow or Block), and the is_isolated field returns true.

Limitations

If a connection closes before Gateway inspects and filters the traffic, Gateway logs the event with an Unknown action.

Gateway activity logs are not available in the dashboard if you turn on the Customer Metadata Boundary (CMB) within Cloudflare Data Localization Suite (DLS). CMB restricts where customer traffic metadata and logs are stored by region. Enterprise users with CMB turned on can still export logs via Logpush. For more information, refer to DLS product compatibility.