Skip to content

Diagnostic logs

The WARP client provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.

macOS/Windows/Linux

Retrieve logs

To view WARP logs on desktop devices:

  1. Open a Terminal window.
  2. Run the warp-diag tool:
    Terminal window
    warp-diag

This will place a warp-debugging-info-<date>-<time>.zip on your Desktop.

warp-diag logs

The warp-debugging-info-<date>-<time>.zip archive contains the following files:

File nameDescription
.qlogQLog files used to debug MASQUE connection issues.
.pcapPacket capture (PCAP) files that were manually generated using warp-cli debug pcap commands.
alternate-networks-check.txtConnectivity status for each managed network.
boringtun.logLog for the WARP tunnel that serves traffic from the device to Cloudflare’s global network.
bound-dns-ports.txtActive processes on port 53.
captive-portal-hotspot-detect.txtHTTP response of captive.apple.com
connectivity.txtDNS resolution and HTTP trace requests to validate a successful connection. Can be used to determine whether traffic is routing through the WARP tunnel.
daemon_dns.logContains detailed DNS logs if Log DNS queries is enabled in the WARP client.
daemon.logDetailed log of all actions performed by the WARP client, including all communication between the device and Cloudflare’s global network. Note: This is the most useful debug log.
date.txtDate and time (UTC) when you ran the warp-diag command.
dex.logLogs related to DEX test execution.
dhcp-lease-plists.txtDHCP lease information from /var/db/dhcpclient/leases/ for each interface that has a DHCP lease.
dhcp-lease.txtDHCP lease information from ipconfig (macOS) or nmcli (Linux).
dig.txtDNS lookup query output for cloudflare.com and apple.com.
dns_stats.logStatistics on the DNS queries received and resolved by WARP, generated every two minutes.
dns-check.txtVerifies that the WARP DNS servers are set as system default. For operating modes where DNS filtering is enabled, this file contains the IPs of the local WARP DNS proxy (127.0.2.2:0, 127.0.2.3:0, [fd01:db8:1111::2]:0, and [fd01:db8:1111::3]:0).
dynamic.logReserved for use by Cloudflare Support.
etc-hosts.txtStatic DNS config of device.
firewall-pfctl-all.txtPacket filter (pf) firewall configuration (macOS only).
firewall-rules.txtThe system firewall rules configured by WARP.
gui-launcher.logmacOS console log showing application launch.
gui-log.logLog file for the GUI app that users interact with.
hostname.txtName of the device.
ifconfig.txt
ipconfig.txt
IP configuration of each network interface.
installed_applications.txtList of installed applications.
installed_cert.pemRoot certificate installed on the system.
installer.log
msi-installer.log
MSI or PKG installation log.
InstallHistory.plist
macos_installer.log
macOS software installation logs.
ipc.logLogs IPC communication between the GUI and daemon. Useful for situations where the GUI crashes or is unable to communicate with the daemon.
kernel-modules.txtList of loaded kernel modules (macOS and Linux) or drivers (Windows).
launchd-dumpstate.txtCurrent state of the macOS launchd system including the loaded jobs, their status, and dependencies.
local_policy.redacted.txt
mdm.plist
mdm.xml
Managed deployment parameters on the device.
lsb-release.txtOutput from the lsb_release command (Linux only).
netstat.txt
routetable.txt
Routing table used by the device.
netstat-v6.txtIPv6 routing table (Linux only).
platform.txtOperating system of the device.
ps.txt
processes.txt
List of all active processes on the device when warp-diag was run.
resolv.confThe contents of the /etc/resolv.conf file on Mac/Linux, where system DNS servers are configured.
route.txtOutput from the ip route get command, used to verify that network traffic is going over the correct interface. You can optionally use the warp-diag --enable-all-routes flag to include tests for all IPs and domains in your Split Tunnel configuration.
scutil-dns.txtDNS configuration on macOS/Linux (available in ipconfig.txt on Windows).
scutil-networkinfo.txtIPv4 and IPv6 network interface configuration on macOS (available in interfaces-config.txt on Windows).
scutil-proxy.txtProxy configuration on macOS/Linux (available in ipconfig.txt on Windows).
snapshots-collection.logLogs generated when collecting snapshots/*.log. Used to debug why WARP failed to collect a snapshot.
snapshots/*.logDiagnostics generated when an error occurs.
stats.logUptime and throughput stats for the WARP tunnel, generated every two minutes.
sw-vers.txtOperating system of the device.
sysinfo.jsonCPU and memory usage when warp-diag was run. This information is useful for determining whether slow speeds are due to heavy system load.
system-extension-diagnostics.txtStatus and health of loaded system extensions (macOS only).
systeminfo.txt
system-profile.txt
System software overview.
System.evtxWindows system event log.
taskdump.logIf the daemon hangs, this file will contain a dump of the currently running processes. This is helpful in debugging hangs, deadlocks, and tasks.
timezone.txtLocal timezone of the device specified as a UTC offset.
traceroute.txtTraceroute to the WARP ingress IPs showing the path from the device to Cloudflare’s global network.
uname.txtLinux-only system information including kernel version.
v4interfaces.txt
v4subinterfaces.txt
v6interfaces.txt
v6subinterfaces.txt
IPv4 and IPv6 network configuration on Windows.
version.txtWARP client version installed on the device.
warp-account.txtWARP client device enrollment information.
warp-bus-metrics.txtMetrics for the internal message bus framework used by the WARP client.
warp-device-posture.txtCurrent device posture status.
warp-dex-data.txtCurrently configured DEX tests and their most recent statuses.
warp-dns-fallbacks.txtList of default DNS fallbacks used by the WARP DNS proxy.
warp-dns-lock.jsonDefault DNS providers and network interface information.
warp-dns-stats.txtSummary of recent DNS queries on the device since dns-stats.log was generated.
warp-network.txtNetwork settings on the device detected by WARP.
warp-settings.txtWARP client settings applied to the device.
warp-stats.txtUptime and throughput of the WARP tunnel since stats.log was generated.
warp-status.txtStatus of WARP switch (Connected or Disconnected).
wdutil-info.txtWi-Fi diagnostics (macOS only).
xpc-launchd.logMost recent log file for the launchd process on macOS.

Multiple versions of the same log

The warp-debugging-info folder may contain multiple versions of the same log, such as daemon.log, daemon.1.log, and daemon.2.log. Since logs can get very long, they are rotated either daily or when they exceed a certain size.

  • <logfile>.log is the most current log. This is almost always the log you should be looking at, as it shows events that occurred on the day you ran the warp-diag command.
  • <logfile>.1.log shows events from the previous day.
  • <logfile>.2.log shows events from two days before.

iOS/Android/ChromeOS

Retrieve logs

To view WARP logs on mobile devices:

  1. Open the 1.1.1.1 app.
  2. Go to Settings > Advanced > Diagnostics.
  3. Scroll down to Debug logs and choose from the available logs.

Mobile app logs

Mobile app logs contain a subset of the information available for desktop clients. To learn more about these files, refer to their equivalent warp-diag logs.

iOS

NameEquivalent warp-diag log
DNS logsdaemon_dns.log
Console logs > Extension logsdaemon.log
Console logs > Application logsconnectivity.txt and gui-log.log
Routing tablenetstat.txt

Android/ChromeOS

NameEquivalent warp-diag log
DNS logsdaemon_dns.log
Console logsconnectivity.txt, netstat.log, and gui-log.log
Native logsdaemon.log