Skip to content

Commit 19d0f83

Browse files
dledfordcfmaxvp
authored and
GregBrimble
committed
Added insight on logging behavior for failed TCP connections (#22034)
Co-authored-by: Max Phillips <[email protected]>
1 parent 0556c11 commit 19d0f83

File tree

1 file changed

+26
-26
lines changed
  • src/content/docs/cloudflare-one/insights/logs/gateway-logs

1 file changed

+26
-26
lines changed

‎src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,14 @@ These settings will only apply to logs displayed in Zero Trust. Logpush data is
5555

5656
#### Identities
5757

58-
| Field | Description |
59-
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
60-
| **Email** | Email address of the user who registered the WARP client where traffic originated from. |
61-
| **User ID** | UUID of the user. Each unique email address in your organization will have a UUID associated with it. |
62-
| **Registration ID** | UUID of the user's WARP client registration. A unique registration ID is generated each time a device is registered for a particular email. The same physical device may have multiple registration IDs. |
63-
| **Device name** | Display name of the device returned by the operating system to the WARP client. Typically this is the hostname of a device. Not all devices will have a device name. Device names are not guaranteed to be unique. |
64-
| **Device ID** | UUID of the device connected with the WARP client. Each physical device in your organization will have a UUID. |
65-
| **Last authenticated** | Date and time the user last authenticated their Zero Trust session. |
58+
| Field | Description |
59+
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
60+
| **Email** | Email address of the user who registered the WARP client where traffic originated from. |
61+
| **User ID** | UUID of the user. Each unique email address in your organization will have a UUID associated with it. |
62+
| **Registration ID** | UUID of the user's WARP client registration. A unique registration ID is generated each time a device is registered for a particular email. The same physical device may have multiple registration IDs. |
63+
| **Device name** | Display name of the device returned by the operating system to the WARP client. Typically this is the hostname of a device. Not all devices will have a device name. Device names are not guaranteed to be unique. |
64+
| **Device ID** | UUID of the device connected with the WARP client. Each physical device in your organization will have a UUID. |
65+
| **Last authenticated** | Date and time the user last authenticated their Zero Trust session. |
6666

6767
#### DNS query details
6868

@@ -123,9 +123,9 @@ These settings will only apply to logs displayed in Zero Trust. Logpush data is
123123
## Network logs
124124

125125
:::caution[Failed connection logs]
126+
Gateway will only log TCP traffic with completed connections. If a connection is not complete (such as a TCP SYN with no SYN ACK), Gateway will not log this traffic in network logs.
126127

127-
Gateway will only log failed connections in [network session logs](/logs/reference/log-fields/account/zero_trust_network_sessions/). These logs are available for Enterprise users via [Logpush](/cloudflare-one/insights/logs/logpush/) or [GraphQL](/cloudflare-one/insights/analytics/gateway/#graphql-queries).
128-
128+
Gateway can log failed connections in [network session logs](/logs/reference/log-fields/account/zero_trust_network_sessions/). These logs are available for Enterprise users via [Logpush](/cloudflare-one/insights/logs/logpush/) or [GraphQL](/cloudflare-one/insights/analytics/gateway/#graphql-queries).
129129
:::
130130

131131
### Explanation of the fields
@@ -152,14 +152,14 @@ Gateway will only log failed connections in [network session logs](/logs/referen
152152

153153
#### Identities
154154

155-
| Field | Description |
156-
| ---------------------- | ----------------------------------------------------------------------------------- |
157-
| **Email** | Email address of the user sending the packet. This is generated by the WARP client. |
158-
| **User ID** | ID of the user sending the packet. This is generated by the WARP client. |
159-
| **Registration ID** | ID of the user's device registration. This is generated by the WARP client. |
160-
| **Device name** | Name of the device that sent the packet. |
161-
| **Device ID** | ID of the physical device that sent the packet. This is generated by the WARP client. |
162-
| **Last authenticated** | Date and time the user last authenticated with Zero Trust. |
155+
| Field | Description |
156+
| ---------------------- | ------------------------------------------------------------------------------------- |
157+
| **Email** | Email address of the user sending the packet. This is generated by the WARP client. |
158+
| **User ID** | ID of the user sending the packet. This is generated by the WARP client. |
159+
| **Registration ID** | ID of the user's device registration. This is generated by the WARP client. |
160+
| **Device name** | Name of the device that sent the packet. |
161+
| **Device ID** | ID of the physical device that sent the packet. This is generated by the WARP client. |
162+
| **Last authenticated** | Date and time the user last authenticated with Zero Trust. |
163163

164164
#### Network query details
165165

@@ -222,22 +222,22 @@ When an HTTP request results in an error, Gateway logs the first 512 bytes of th
222222

223223
#### Identities
224224

225-
| Field | Description |
226-
| ---------------------- | -------------------------------------------------------------------------------------------------------------------- |
227-
| **Email** | Email address of the user who made the HTTP request. This is generated by the WARP client. |
228-
| **User ID** | ID of the user who made the request. This is generated by the WARP client. |
229-
| **Registration ID** | ID of the user's device registration. This is generated by the WARP client. |
230-
| **Device name** | Name of the device that made the request. |
225+
| Field | Description |
226+
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
227+
| **Email** | Email address of the user who made the HTTP request. This is generated by the WARP client. |
228+
| **User ID** | ID of the user who made the request. This is generated by the WARP client. |
229+
| **Registration ID** | ID of the user's device registration. This is generated by the WARP client. |
230+
| **Device name** | Name of the device that made the request. |
231231
| **Device ID** | ID of the physical device that made the request. This is generated by the WARP client on the device that created the request. |
232-
| **Last authenticated** | Date and time the user last authenticated with Zero Trust. |
232+
| **Last authenticated** | Date and time the user last authenticated with Zero Trust. |
233233

234234
#### HTTP query details
235235

236236
| Field | Description |
237237
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
238238
| **HTTP Version** | HTTP version of the origin that Gateway connected to on behalf of the user. |
239239
| **HTTP Method** | HTTP method used for the request (such as `GET` or `POST`). |
240-
| **HTTP Status Code** | [HTTP status code](/support/troubleshooting/http-status-codes/) returned in the response. |
240+
| **HTTP Status Code** | [HTTP status code](/support/troubleshooting/http-status-codes/) returned in the response. |
241241
| **URL** | Full URL of the HTTP request. |
242242
| **Referer** | Referer request header containing the address of the page making the request. |
243243
| **Source IP** | Public source IP address of the HTTP request. |

0 commit comments

Comments
 (0)