You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Find security misconfigurations in your AWS cloud environment
3
+
description: CASB and DLP with Cloud Data Extraction for AWS cloud environments
4
+
date: 2024-11-22T11:00:00Z
5
+
products:
6
+
- dlp
7
+
---
8
+
9
+
import { Render } from"~/components";
10
+
11
+
You can now use CASB to find security misconfigurations in your AWS cloud environment using [Data Loss Prevention](/cloudflare-one/policies/data-loss-prevention/).
12
+
13
+
You can also [connect your AWS compute account](/cloudflare-one/applications/casb/casb-integrations/aws-s3/#compute-account) to extract and scan your S3 buckets for sensitive data while avoiding egress fees. CASB will scan any objects that exist in the bucket at the time of configuration.
The latest `cloudflared` build [2024.12.2](https://github.com/cloudflare/cloudflared/releases/tag/2024.12.2) introduces the ability to collect all the diagnostic logs needed to troubleshoot a `cloudflared` instance.
10
+
11
+
A diagnostic report collects data from a single instance of `cloudflared` running on the local machine and outputs it to a `cloudflared-diag` file.
title: Increased transparency for phishing email submissions
3
+
description: New Email reclassifications tab
4
+
date: 2024-12-19T11:00:00Z
5
+
---
6
+
7
+
import { Render } from"~/components";
8
+
9
+
Customers now have more transparency about team and user submissions for phishing emails through a **Reclassification** tab in the Zero Trust dashboard.
10
+
11
+
Reclassifications happen when users or admins [submit a phish](/cloudflare-one/email-security/phish-submissions/) to Email Security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models.
12
+
13
+
This new tab increases your visibility into this process, allowing you to view what submissions you have made and what the outcomes of those submissions are.
14
+
15
+
{/* Need screenshot here + more details potentially */}
title: Block files that are password-protected, compressed, or otherwise unscannable.
3
+
description: Unscannable files for Download and Upload File Types selectors
4
+
date: 2025-02-03T11:00:00Z
5
+
products:
6
+
- dlp
7
+
---
8
+
9
+
import { Render } from"~/components";
10
+
11
+
Gateway HTTP policies can now block files that are password-protected, compressed, or otherwise unscannable.
12
+
13
+
These unscannable files are now matched with the [Download and Upload File Types traffic selectors](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-file-types) for HTTP policies:
To get started inspecting and modifying behavior based on these and other rules, refer to [HTTP filtering](/cloudflare-one/policies/gateway/initial-setup/http/).
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs.mdx
+68-84Lines changed: 68 additions & 84 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ sidebar:
6
6
label: Diagnostic logs
7
7
---
8
8
9
-
import {Details} from"~/components";
9
+
import {Details, Render} from"~/components";
10
10
11
11
Cloudflare Tunnel generates a set of diagnostic logs that can be used to troubleshoot issues with `cloudflared`. A diagnostic report collects data from a single instance of `cloudflared` running on the local machine.
12
12
@@ -22,129 +22,113 @@ The steps for getting diagnostic logs depend on your `cloudflared` deployment en
22
22
23
23
These instructions apply to remotely-managed and locally-managed tunnels running directly on the host machine.
24
24
25
-
1. (Linux only) To include network diagnostics in the logs, allow the `cloudflared` user to create RAW and PACKET sockets without root permissions:
25
+
1.(Linux only) To include network diagnostics in the logs, allow the `cloudflared` user to create RAW and PACKET sockets without root permissions:
If you do not set `cap_net_raw`, then traceroute data will be unavailable.
31
+
If you do not set `cap_net_raw`, then traceroute data will be unavailable.
32
32
33
-
2. Get diagnostic logs:
33
+
2.Get diagnostic logs:
34
34
35
-
```sh
36
-
cloudflared tunnel diag
37
-
```
35
+
```sh
36
+
cloudflared tunnel diag
37
+
```
38
38
39
-
If multiple instances of `cloudflared` are running on the same host, specify the [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#configure-the-metrics-server-address) for the instance you want to diagnose. For example:
39
+
If multiple instances of `cloudflared` are running on the same host, specify the [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#configure-the-metrics-server-address) for the instance you want to diagnose. For example:
40
40
41
-
```sh
42
-
cloudflared tunnel diag --metrics 127.0.0.1:20241
43
-
```
41
+
```sh
42
+
cloudflared tunnel diag --metrics 127.0.0.1:20241
43
+
```
44
44
45
45
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
46
46
47
47
### Docker
48
48
49
49
`cloudflared` reads diagnostic data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/). To get diagnostic logs, the metrics server must be exposed from the Docker container and reachable from the host machine.
50
50
51
-
1. Determine the [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address) for the `cloudflared` instance running in Docker.
51
+
1.Determine the [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address) for the `cloudflared` instance running in Docker.
52
52
53
-
2. Ensure the container is deployed with port forwarding enabled. The diagnostic feature will request information from the Docker instance using local port `20241`, therefore you should forward port `20241` to the container port obtained in Step 1:
53
+
2.Ensure the container is deployed with port forwarding enabled. The diagnostic feature will request information from the Docker instance using local port `20241`, therefore you should forward port `20241` to the container port obtained in Step 1:
54
54
55
-
```sh
56
-
docker run -d -p 20241:<metrics_port> docker.io/cloudflare/cloudflared tunnel ...
57
-
```
55
+
```sh
56
+
docker run -d -p 20241:<metrics_port> docker.io/cloudflare/cloudflared tunnel ...
57
+
```
58
58
59
-
3. Verify that you can reach the metrics server address from the Docker host environment:
59
+
3.Verify that you can reach the metrics server address from the Docker host environment:
Running the diagnostic command with the container ID allows `cloudflared` to collect information from the Docker environment such as logs and container details.
91
+
Running the diagnostic command with the container ID allows `cloudflared` to collect information from the Docker environment such as logs and container details.
92
92
93
93
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
94
94
95
95
### Kubernetes
96
96
97
97
The diagnostic feature will request data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/) using ports `20241` to `20245`. You will need to use port forwarding to allow the local `cloudflared` instance to connect to the metrics server on one of these ports.
98
98
99
-
1. Determine the tunnel's [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address).
99
+
1.Determine the tunnel's [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address).
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
131
131
132
132
## cloudflared-diag files
133
133
134
-
The `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` archive contains the files listed below. The data in a file either applies to the `cloudflared` instance being diagnosed (`diagnosee`) or the instance that triggered the diagnosis (`diagnoser`). For example, if your tunnel is running in a Docker container, the diagnosee is the Docker instance and the diagnoser is the host instance.
135
-
136
-
| File name | Description | Instance |
137
-
| -| - | - |
138
-
|`cli-configuration.json`|[Tunnel run parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/) used when starting the tunnel | diagnosee|
|`goroutine.pprof`| goroutine profile made available by `pprof`| diagnosee|
142
-
|`heap.pprof`| heap profile made available by `pprof`| diagnosee|
143
-
|`metrics.txt`| Snapshot of [Tunnel metrics](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#available-metrics) at the time of diagnosis | diagnosee|
144
-
|`network.txt`| JSON traceroutes to Cloudflare's global network using IPv4 and IPv6 | diagnoser|
145
-
|`raw-network.txt`| Raw traceroutes to Cloudflare's global network using IPv4 and IPv6 | diagnoser|
146
-
|`systeminformation.json`| Operating system information and resource usage | diagnosee|
147
-
|`task-result.json`| Result of each diagnostic task | diagnoser |
148
-
|`tunnelstate.json`| Tunnel connections at the time of diagnosis| diagnosee|
149
-
150
-
[^1]: If the log file is blank, you may need to [set `--loglevel` to `debug`](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/#view-logs-on-the-server) when you start the tunnel. The `--loglevel` parameter is only required if you ran the tunnel from the CLI using a `cloudflared tunnel run` command. It is not necessary if the tunnel runs as a Linux/macOS service or runs in Docker/Kubernetes.
0 commit comments