Cloudflare Docs
Cloudflare Zero Trust
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)

Gateway activity logs

Gateway activity logs show the individual DNS queries, Network packets, and HTTP requests inspected by Gateway. You can also download encrypted SSH command logs for sessions proxied by Gateway.

To view Gateway activity logs, log in to Zero Trust and go to Logs > Gateway. Select an individual row to investigate the event in more detail.

Enterprise users can generate more detailed logs with Logpush.

​​ Selective logging

By default, Gateway logs all events, including DNS queries and HTTP requests that are allowed and not a risk. You can choose to disable logs or only log blocked requests. To customize what type of events are recorded, log in to Zero Trust and go to Settings > Network. Under Activity Logging, indicate your DNS, Network, and HTTP log preferences.

These settings will only apply to logs displayed in Zero Trust. Logpush data is unaffected.

​​ DNS logs

​​ Explanation of the fields

FieldDescription
DNSName of the domain that was queried.
EmailEmail address of the user who registered the WARP client where traffic originated from. If a non-identity on-ramp (such as a proxy endpoint) or machine-level authentication (such as a service token) was used, this value will be non_identity@<team-domain>.cloudflareaccess.com.
EventThe Action Gateway applied to the query (for example, Allow or Block).
DateDate and time of the DNS query.
Source IPPublic source IP address of the DNS query.
PortPort that was used to make the DNS query.
Source IP CountryCountry code of the DNS query.
Resolver IPPublic IP address of the DNS resolver.
Source Internal IPPrivate IP address assigned by the user’s local network.
ProtocolProtocol that was used to make the DNS query (for example, https).
Query TypeType of DNS query. This page contains a list of all the DNS query types.
Resolver DecisionThe reason why Gateway applied a particular Action to the request. Refer to the list of resolver decisions.
DNS LocationUser-configured location from where the DNS query was made.
Policy NameName of the matched policy (if there is one).
Policy IDID of the matched policy (if there is one).
CategoriesContent categories that the domain belongs to.
User IDUUID of the user. Each unique email address in your organization will have a UUID associated with it.
Device IDUUID of the device connected with the WARP client. Each unique device in your organization will have a UUID associated with it each time the device is registered for a particular email. The same physical device may have multiple UUIDs associated with it.
Location IDID of the DNS location where the query originated.
Device NameDisplay name of the device returned by the operating system to the WARP client. Typically this is the hostname of a device. Not all devices will have a device name. Device names are not guaranteed to be unique.
Resolved IPsResolved IP addresses in the response (if any).
Matched Indicator Feed NameName of the indicator feeds that matched a Gateway policy (if any).
Query Indicator Feed NameName of the indicator feeds that a matched domain or IP belongs to (if any).

​​ Resolver decisions

ValueDescription
allowedByQueryNameDomain or hostname in the query matched an Allow policy.
blockedByQueryNameDomain or hostname in the query matched a Block policy.
allowedRuleIP address in the response matched an Allow policy.
blockedRuleIP address in the response matched a Block policy.
blockedByCategoryDomain or hostname matched a category in a Block policy.
blockedAlwaysCategoryDomain or hostname is always blocked by Cloudflare.
allowedOnNoLocationAllowed because query did not match a Gateway DNS location.
allowedOnNoPolicyMatchAllowed because query did not match a policy.
overrideForSafeSearchResponse was overridden by a Safe Search policy.
overrideAppliedResponse was overridden by an Override policy.

​​ Network logs

​​ Explanation of the fields

FieldDescription
Source IPIP address of the user sending the packet.
Destination IPIP address of the packet’s target.
ActionThe Gateway Action taken based on the first rule that matched (for example, Allow or Block).
Session IDID of the unique session.
TimeDate and time of the session.
Source PortSource port number for the packet.
Source IP CountryCountry code for the packet source.
Source Internal IPPrivate IP address assigned by the user’s local network.
Destination PortDestination port number for the packet.
Destination IP CountryCountry code for the packet destination.
ProtocolProtocol over which the packet was sent.
Detected ProtocolThe detected network protocol.
SNIHost whose Server Name Indication (SNI) header Gateway will filter traffic against.
Virtual NetworkVirtual network that the client is connected to.
CategoriesCategory or categories associated with the packet.
Policy NameName of the matched policy (if there is one).
Policy IDID of the policy enforcing the decision Gateway made.
EmailEmail address of the user sending the packet. This is generated by the WARP client.
User IDID of the user sending the packet. This is generated by the WARP client.
Device IDID of the device that sent the packet. This is generated by the WARP client.
Device NameName of the device that sent the packet.

​​ HTTP logs

​​ Explanation of the fields

FieldDescription
HostHostname in the HTTP header for the HTTP request.
EmailEmail address of the user who made the HTTP request. This is generated by the WARP client.
ActionThe Gateway Action taken based on the first rule that matched (for example, Allow or Block).
Request IDUnique ID of the request.
TimeDate and time of the HTTP request.
URLFull URL of the HTTP request.
RefererReferer request header containing the address of the page making the request.
HTTP VersionHTTP version of the origin that Gateway connected to on behalf of the user.
HTTP MethodHTTP method used for the request (for example, GET or POST).
HTTP Status CodeHTTP status code returned in the response.
Source IPPublic source IP address of the HTTP request.
Source PortPort that was used to make the HTTP request.
Source IP CountryCountry code of the HTTP request.
Source Internal IPPrivate IP address assigned by the user’s local network.
Destination IPPublic IP address of the destination requested.
Destination PortPort of the destination requested.
Destination IP CountryCountry code of the destination requested.
Blocked file reasonReason why the file was blocked if a file transfer occurred or was attempted.
Policy NameName of the matched policy (if there is one).
Policy IDID of the matched policy (if there is one).
Policy DescriptionDescription of the matched policy (if there is one).
User IDID of the user who made the request. This is generated by the WARP client.
Device NameName of the device that made the request.
Device IDID of the device that made the request. This is generated by the WARP client on the device that created the request.
User AgentUser agent header sent in the request by the originating device.
Policy detailsPolicy corresponding to the decision Gateway made based on the traffic criteria of the request.
DLP profilesName of the matched DLP profile (if there is one).
DLP profile entriesName of the matched entry within the DLP profile (if there is one).
Uploaded/downloaded fileThe file transferred in the request. Details include:
  • File name
  • File type
  • File size
  • File hash (for Allowed requests only)
  • Content type
  • Direction (Upload/Download)
  • Action (Block/Allow)
For more accurate logging, enable enhanced file detection.

​​ Enhanced file detection

Enhanced file detection is an optional feature to extract more file information from HTTP traffic. When enabled, Gateway will read file information from the HTTP body rather than the HTTP headers, offering greater accuracy and reliability. This feature may have a minor impact on performance for file-heavy organizations.

To enable:

  1. Go to Settings > Network.
  2. Enable TLS decryption.
  3. Turn on Enable enhanced file detection.

​​ Isolate requests

When a user creates a policy to isolate traffic, the initial request that triggers isolation will be logged as an Isolate decision and the is_isolated field will return false. This is because that initial request is not isolated yet — but it initiates an isolated session.

Since the request is generated in an isolated browser, the result is rendered in the isolated browser and rendered back to the user securely. This request and all subsequent requests in the isolated browser are logged to include the terminal Gateway action that gets applied (e.g. Allow / Block) and the is_isolated field as true.