---
title: WARP diagnostic logs · Cloudflare Zero Trust docs
description: The WARP client provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.
lastUpdated: 2025-04-25T21:52:27.000Z
source_url:
  html: https://patricia-pcx17119-l7-overrides.preview.developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/index.md
  md: https://patricia-pcx17119-l7-overrides.preview.developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/
---

The WARP client provides diagnostic logs that you can use to troubleshoot connectivity issues on a device.

## macOS/Windows/Linux

### Retrieve logs

To view WARP logs on desktop devices:

* macOS

  1. Open a Terminal window.

  2. Run the `warp-diag` tool:

     ```sh
     warp-diag
     ```

  This will place a `warp-debugging-info-<date>-<time>.zip` on your desktop.

* Windows

  1. Open a Command Prompt or PowerShell window.

  2. Run the `warp-diag` tool:

     ```bash
     C:\Users\JohnDoe>warp-diag
     ```

  This will place a `warp-debugging-info-<date>-<time>.zip` on your desktop.

* Linux

  1. Open a Terminal window.

  2. Run the `warp-diag` tool:

     ```sh
     warp-diag
     ```

  This will place a `warp-debugging-info-<date>-<time>.zip` in the same folder you ran the command from.

Note

You can also use Digital Experience Monitoring to run `warp-diag` commands on remote devices. For more information, refer to [Remote captures](https://developers.cloudflare.com/cloudflare-one/insights/dex/remote-captures/).

### `warp-diag` logs

The `warp-debugging-info-<date>-<time>.zip` archive contains the following files:

| File name | Description |
| - | - |
| `.qlog` | QLog files used to debug MASQUE connection issues. |
| `.pcap` | Packet capture (PCAP) files that were manually generated using `warp-cli debug pcap` commands. |
| `alternate-networks-check.txt` | Connectivity status for each [managed network](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/). |
| `boringtun.log` | Log for the WARP tunnel that serves traffic from the device to Cloudflare's global network. |
| `bound-dns-ports.txt` | Active processes on port `53`. |
| `captive-portal-hotspot-detect.txt` | HTTP response of `captive.apple.com` |
| `connectivity.txt` | DNS resolution and HTTP trace requests to [validate a successful connection](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#connectivity-checks). Can be used to determine whether traffic is routing through the WARP tunnel. |
| `daemon_dns.log` | Contains detailed DNS logs if **Log DNS queries** is enabled in the WARP client. |
| `daemon.log` | Detailed log of all actions performed by the WARP client, including all communication between the device and Cloudflare's global network. **Note:** This is the most useful debug log. |
| `date.txt` | Date and time (UTC) when you ran the `warp-diag` command. |
| `dex.log` | Logs related to [DEX test](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) execution. |
| `dhcp-lease-plists.txt` | DHCP lease information from `/var/db/dhcpclient/leases/` for each interface that has a DHCP lease. |
| `dhcp-lease.txt` | DHCP lease information from `ipconfig` (macOS) or `nmcli` (Linux). |
| `dig.txt` | DNS lookup query output for `cloudflare.com` and `apple.com`. |
| `dns_stats.log` | Statistics on the DNS queries received and resolved by WARP, generated every two minutes. |
| `dns-check.txt` | Verifies that the WARP DNS servers are set as system default. For [operating modes](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) where DNS filtering is enabled, this file contains the IPs of the local WARP DNS proxy (`127.0.2.2:0`, `127.0.2.3:0`, `[fd01:db8:1111::2]:0`, and `[fd01:db8:1111::3]:0`). |
| `dynamic.log` | Reserved for use by Cloudflare Support. |
| `etc-hosts.txt` | Static DNS config of device. |
| `firewall-pfctl-all.txt` | Packet filter (pf) firewall configuration (macOS only). |
| `firewall-rules.txt` | The [system firewall rules](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall) configured by WARP. |
| `gui-launcher.log` | macOS console log showing application launch. |
| `gui-log.log` | Log file for the GUI app that users interact with. |
| `hostname.txt` | Name of the device. |
| `ifconfig.txt` `ipconfig.txt` | IP configuration of each network interface. |
| `installed_applications.txt` | List of installed applications. |
| `installed_cert.pem` | [Root certificate](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/user-side-certificates/) installed on the system. |
| `installer.log` `msi-installer.log` | MSI or PKG installation log. |
| `InstallHistory.plist` `macos_installer.log` | macOS software installation logs. |
| `ipc.log` | Logs IPC communication between the GUI and daemon. Useful for situations where the GUI crashes or is unable to communicate with the daemon. |
| `kernel-modules.txt` | List of loaded kernel modules (macOS and Linux) or drivers (Windows). |
| `launchd-dumpstate.txt` | Current state of the macOS `launchd system` including the loaded jobs, their status, and dependencies. |
| `local_policy.redacted.txt` `mdm.plist` `mdm.xml` | [Managed deployment parameters](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) on the device. |
| `lsb-release.txt` | Output from the `lsb_release` command (Linux only). |
| `netstat.txt` `routetable.txt` | Routing table used by the device. |
| `netstat-v6.txt` | IPv6 routing table (Linux only). |
| `platform.txt` | Operating system of the device. |
| `ps.txt` `processes.txt` | List of all active processes on the device when `warp-diag` was run. |
| `resolv.conf` | The contents of the `/etc/resolv.conf` file on Mac/Linux, where system DNS servers are configured. |
| `route.txt` | Output from the `ip route get` command, used to verify that network traffic is going over the correct interface. You can optionally use the `warp-diag --enable-all-routes` flag to include tests for all IPs and domains in your Split Tunnel configuration. |
| `scutil-dns.txt` | DNS configuration on macOS/Linux (available in `ipconfig.txt` on Windows). |
| `scutil-networkinfo.txt` | IPv4 and IPv6 network interface configuration on macOS (available in `interfaces-config.txt` on Windows). |
| `scutil-proxy.txt` | Proxy configuration on macOS/Linux (available in `ipconfig.txt` on Windows). |
| `snapshots-collection.log` | Logs generated when collecting `snapshots/*.log`. Used to debug why WARP failed to collect a snapshot. |
| `snapshots/*.log` | Diagnostics generated when an error occurs. |
| `stats.log` | Uptime and throughput stats for the WARP tunnel, generated every two minutes. |
| `sw-vers.txt` | Operating system of the device. |
| `sysinfo.json` | CPU and memory usage when `warp-diag` was run. This information is useful for determining whether slow speeds are due to heavy system load. |
| `system-extension-diagnostics.txt` | Status and health of loaded system extensions (macOS only). |
| `systeminfo.txt` `system-profile.txt` | System software overview. |
| `System.evtx` | Windows system event log. |
| `taskdump.log` | If the daemon hangs, this file will contain a dump of the currently running processes. This is helpful in debugging hangs, deadlocks, and tasks. |
| `timezone.txt` | Local timezone of the device specified as a UTC offset. |
| `traceroute.txt` | Traceroute to the [WARP ingress IPs](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) showing the path from the device to Cloudflare's global network. |
| `uname.txt` | Linux-only system information including kernel version. |
| `v4interfaces.txt` `v4subinterfaces.txt` `v6interfaces.txt` `v6subinterfaces.txt` | IPv4 and IPv6 network configuration on Windows. |
| `version.txt` | [WARP client version](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/) installed on the device. |
| `warp-account.txt` | WARP client device enrollment information. |
| `warp-bus-metrics.txt` | Metrics for the internal message bus framework used by the WARP client. |
| `warp-device-posture.txt` | Current [device posture](https://developers.cloudflare.com/cloudflare-one/identity/devices/warp-client-checks/) status. |
| `warp-dex-data.txt` | Currently configured [DEX tests](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) and their most recent statuses. |
| `warp-dns-fallbacks.txt` | List of default DNS fallbacks used by the WARP DNS proxy. |
| `warp-dns-lock.json` | Default DNS providers and network interface information. |
| `warp-dns-stats.txt` | Summary of recent DNS queries on the device since `dns-stats.log` was generated. |
| `warp-network.txt` | Network settings on the device detected by WARP. |
| `warp-settings.txt` | [WARP client settings](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/) applied to the device. |
| `warp-stats.txt` | Uptime and throughput of the WARP tunnel since `stats.log` was generated. |
| `warp-status.txt` | Status of WARP switch (`Connected` or `Disconnected`). |
| `wdutil-info.txt` | Wi-Fi diagnostics (macOS only). |
| `xpc-launchd.log` | Most recent log file for the `launchd` process on macOS. |

#### Multiple versions of the same log

The `warp-debugging-info` folder may contain multiple versions of the same log, such as `daemon.log`, `daemon.1.log`, and `daemon.2.log`. Since logs can get very long, they are rotated either daily or when they exceed a certain size.

* `<logfile>.log` is the most current log. This is almost always the log you should be looking at, as it shows events that occurred on the day you ran the `warp-diag` command.
* `<logfile>.1.log` shows events from the previous day.
* `<logfile>.2.log` shows events from two days before.

Note

In timestamped logs such as `daemon.log`, the most recent events will appear at the end of the file.

## iOS/Android/ChromeOS

### Retrieve logs

To view WARP logs on mobile devices:

1. Open the 1.1.1.1 app.
2. Go to **Settings** > **Advanced** > **Diagnostics**.
3. Scroll down to **Debug logs** and choose from the [available logs](#mobile-app-logs).

### Mobile app logs

Mobile app logs contain a subset of the information available for desktop clients. To learn more about these files, refer to their equivalent [warp-diag logs](#warp-diag-logs).

#### iOS

| Name | Equivalent warp-diag log |
| - | - |
| **DNS logs** | `daemon_dns.log` |
| **Console logs** > **Extension logs** | `daemon.log` |
| **Console logs** > **Application logs** | `connectivity.txt` and `gui-log.log` |
| **Routing table** | `netstat.txt` |

#### Android/ChromeOS

| Name | Equivalent warp-diag log |
| - | - |
| **DNS logs** | `daemon_dns.log` |
| **Console logs** | `connectivity.txt`, `netstat.log`, and `gui-log.log` |
| **Native logs** | `daemon.log` |
