The live log shows every request passing through the node in real time: who came, to which domain, what the backend responded, and how long it took. It is the fastest way to understand what is happening with your traffic right now — without access to the backend and without parsing files.
The log is not written to disk: the node sends lines only to those who have the viewer page open at that moment. We do not see or store your traffic — the log lives only on your node.
How to Enable#
The log is disabled by default. It is enabled with environment variables in the /opt/wafclient/.env file on the node.
- Connect to the node via SSH and add the following to
/opt/wafclient/.env:
LOGROUTE=/my-secret-log
LOGUSER=admin
LOGPASS=strong-password- Restart the service:
systemctl restart privateflare- Open the log address in a browser on any domain served by this node:
https://your-domain.com/my-secret-logThe browser will ask for a login and password — enter the LOGUSER and LOGPASS values.
| Variable | Description | Default |
|---|---|---|
LOGROUTE | Address of the log page. If not set, the log is disabled | disabled |
LOGUSER | Login | log |
LOGPASS | Password | log |
LOGFORMAT | Line format: json or text | text |
Important: the log page is available on any domain of the node. Set your own password and a non-obvious address instead of
/log— the default values are publicly known.
Viewer Page#
On the page, new requests appear immediately, without refreshing:
- Indicator on the left shows the connection status: green means the log is coming in. If the connection drops, the page reconnects automatically.
- Filter keeps only the lines containing the specified text — for example, a domain, an IP or a response code.
- Autoscroll scrolls the log to new lines. Turn it off to study a specific fragment without interruption.
The page keeps the last 2000 lines. A viewing session is valid for 24 hours, after which the page needs to be opened again.
Line Format#
Text (Default)#
The format is close to the Nginx access log:
203.0.113.7 - DE [04/Oct/2026:12:30:15 +0000] "GET https://example.com/landing HTTP/2.0" 200 "https://google.com/" "Mozilla/5.0 ..." rt=0.142 uct=0.118| Field | Meaning |
|---|---|
203.0.113.7 | Visitor IP |
DE | Visitor country |
[04/Oct/2026:12:30:15 +0000] | Request time |
"GET https://example.com/landing HTTP/2.0" | Method, full URL and protocol |
200 | Response code |
"https://google.com/" | Referer |
"Mozilla/5.0 ..." | User-Agent |
rt | Total request processing time, in seconds |
uct | Backend response time, in seconds. - if the request did not reach the backend |
JSON#
Set LOGFORMAT=json if the log is read by a script or an external system:
{"time":"2026-10-04T12:30:15Z","status":200,"duration_ms":142,"backend_ms":118,"ip":"203.0.113.7","geo":"DE","method":"GET","host":"example.com","path":"/landing","ua":"Mozilla/5.0 ...","proto":"HTTP/2.0","tls":true}| Field | Meaning |
|---|---|
time | Request time |
status | Response code |
duration_ms | Total request processing time, in milliseconds |
backend_ms | Backend response time, in milliseconds. null if the request did not reach the backend |
ip | Visitor IP |
geo | Visitor country |
method | HTTP method |
host | Domain |
path | Request path |
ua | User-Agent |
proto | Protocol |
tls | true — the request came over HTTPS |
By comparing duration_ms and backend_ms (or rt and uct), it is easy to see where time is lost: on the backend or on the way to it.
What Is Not Logged#
- Requests from the PrivateFlare service bot (domain availability checks) — to keep the log uncluttered.
- Requests made before the page was opened: the log does not keep history.
How to Disable#
Remove the LOGROUTE line from /opt/wafclient/.env and restart the service:
systemctl restart privateflareThe Service’s Own Log#
Client messages about startup and errors are written to the system journal. You can view them with the command:
journalctl -u privateflare -f