Evaluate logs by stage: DNS, TCP connection, TLS or protocol handshake, rule matching, and control interface. Find the first failure, then use keywords such as lookup, dial, and handshake to locate it. Keep only the log segment needed for one reproduction and include the client, core, and system versions. Before sharing, redact the URL, token, secret, IP address, and node credentials.
Which log line should I read first?
Starting from the time of the reproduction, find the first error and classify the stage using lookup, dial, handshake, parse, or unauthorized.
- Does the error include lookup, dial, connect, handshake, unauthorized, or parse?
- Does the error occur during subscription update, node connection, or Dashboard access?(See Runtime Control)
- Does only a specific domain or node trigger it?
- Is the log level detailed enough without being excessive?
Continue troubleshooting by error stage
- First identify the time and action associated with the error
- Use keywords to determine the error stage
- Redact the complete subscription URL, token, node password, and real IP address before sharing(See Security FAQ)
- Record the client version, core version, system version, and configuration source when reproducing
debug logs are useful for short troubleshooting sessions and should not remain enabled
Logs may contain domains, IP addresses, node names, a subscription URL, or secrets
A screenshot of only the final line is usually not enough to diagnose the issue