Access Log
See every connection to your fleet devices, live and past, with the identity, device and port, source address, outcome, duration and traffic.
Summary
Needs a fleet, which is on the Pro and Enterprise plans. See Fleets to create one.
What the access log records#
Open Access log in the dashboard sidebar.
Each entry is one access session to one port on one device. An access session is the connection localport access holds to a device. It opens when the first forward reaches a port. It ends when the command stops, or after 5 minutes with no forward open. One session forwarding two ports leaves two entries.
An entry appears within seconds of the session opening and is marked Active while the session stays open. Its counters refresh every 5 minutes. When the session ends, the entry records the close time and the reason.
Nothing about the contents is recorded. No request path, header or body is captured anywhere. The log keeps counts: bytes each way, connections on a tcp port, and requests and response classes on an http port.
Refusals are recorded too. A refusal inside a session is counted on that session's entry and names the port. A caller refused before it proves an identity is counted per minute, with its address.
How to read an entry#
| Column | Holds |
|---|---|
| When | When the session opened |
| Identity | The person or machine, by name where one resolves |
| Reached | The device and port, the port's protocol, and the fleet under it |
| From | The source address |
| Outcome | Active, Allowed, Failed, or the reason it was denied |
| Duration | How long the session lasted, counting up while it is Active |
| Traffic | Bytes both ways, with the connection count on tcp or the request count on http |
Expand an entry for the exact open time in UTC and in your timezone, the close time and why the session ended, the allowed, refused and failed counts, bytes to and from the device, the response classes on an http port, the certificate serial, the device and the fleet.
What each outcome means#
| Outcome | Meaning |
|---|---|
| Active | The session is open now |
| Allowed | The session connected and ended |
| Failed | Every connection passed the access check and the device could not serve any of them |
| Denied | No connection in the entry passed the access check |
An Allowed or Active entry can carry a note such as 2 refused or 1 failed. The note counts connections inside an otherwise working session that were refused or could not be served.
An Active entry reads No recent report when its counters have not refreshed for 7 minutes. That happens when a service interruption stops the session from being reported.
Why a connection was denied or failed#
| Label | What happened |
|---|---|
| No certificate | No client certificate was presented |
| No access | No grant lets this identity reach this device |
| Certificate expired | The client certificate had expired |
| Certificate revoked | The client certificate has been revoked |
| Port not open | The device does not serve the port the caller asked for |
| IP not allowed | The source address is not on this fleet's IP allowlist |
| Refusal flood | Too many identities were refused in one minute to list separately |
| Device unreachable | The device could not connect to its local service on this port |
| Too many streams | The device already had as many open streams as it allows |
| Bandwidth limit | The team's bandwidth limit was reached |
The caller is told none of this. The agent reports that access was refused without naming the condition. The exact reason is here, where only your team can read it.
Why a session ended#
| Ended | Cause |
|---|---|
| Closed by the client | localport access stopped |
| Closed after idling | No forward was open for 5 minutes |
| Device went offline | The device's agent disconnected |
| Device removed from the fleet | The device was removed |
| Fleet deleted | The fleet was deleted |
| Access removed | A grant change stopped covering this device for this identity |
| Certificate expired | The certificate reached its expiry during the session |
| Certificate revoked | The certificate was revoked during the session |
| Certificate authority removed | The authority that issued the certificate was removed |
| Source IP no longer allowed | The fleet's IP allowlist stopped covering the address |
| Port removed from the device | The port was removed from the device |
| Fleet token revoked | The fleet's token was revoked |
| Team bandwidth limit reached | The team reached its bandwidth limit |
| Plan no longer allows it | The team's plan stopped covering fleets |
| Localport service restarted | The service carrying the session restarted |
| Connection lost during a service interruption | The service stopped unexpectedly and the entry closed at its last report |
How to find one connection#
Search, fields and a time range narrow the log.
- Search matches people by name, email or username, machine identities, and device names.
- Outcome narrows to Active now, Allowed, Failed or Denied. An entry appears under every outcome it contains.
- Port matches one device port exactly.
- Source IP matches one address exactly, including inside summary entries.
- Time range covers the last 24 hours, 7, 30 or 90 days, or everything retained. Active now ignores the range.
Links from elsewhere open the log already filtered. A certificate's What this reached, a grant's Access log and a device's Access log each open it scoped to that subject. The page names the filter and links to Show everything.
The log is newest first. Newer and Older step through it, and the first-page control returns to the newest entries. When new entries arrive, the page shows how many above the table, and Show loads them.
Entries that summarise many sessions#
One identity can open many short sessions from one address to one port. Past 60 in an hour, those sessions are summed into one entry per minute. The entry states how many sessions it covers.
Refusals before an identity is proven are summed the same way, one entry per minute per address and reason.
A summary entry covering several source addresses lists each address with its count. Several addresses behind one identity is normal. Certificate rollover, a person on two machines, a shared CI identity and NAT all produce it.
How to export the access log#
Export CSV downloads every entry that matches your filters, newest first. An export stops at 100,000 rows and ends with a line saying so. Narrow the time range to export the rest.
Each row carries the times, the outcome, the refusal and end reasons, the identity with its resolved name and email, the fleet, the device, port and protocol, the source addresses, the certificate serial, and every count.
Cells a spreadsheet would read as a formula are escaped. On plans with the team audit log, each export is recorded there.
Who can read it and for how long#
Reading the access log needs the admin or owner role. Every entry carries a source address.
Your retention window is shown beside the page title. Older entries are not returned. See pricing for what each plan retains.
Entries outlive what they describe. Deleting a fleet, revoking a certificate or removing a member leaves their history readable. Deleting the team deletes its access log.
The recent-access drawer on a fleet's Access tab shows the latest entries for that fleet, or for one grant's subject.
Frequently asked questions#
Does Localport log the contents of my traffic?
No. The access log records sessions and counts: who connected, which device and port, when, from where, for how long, bytes each way, and connection or request counts. No request path, header or body is captured anywhere.
Can I see who is connected right now?
Yes. Set Outcome to Active now. Every open session is listed with its identity, device, port and a duration that counts up.
How soon does a connection appear?
Within seconds of the session opening. Its counters refresh every 5 minutes while it stays open, and the entry is completed when the session ends.
Why does one localport access command leave several entries?
Each entry covers one port. A command forwarding two ports leaves one entry per port. A new session also starts after 5 minutes with no forward open, or after the command reconnects.
Why was a connection denied?
The entry's Outcome names the reason, such as No access or Port not open, and the expanded entry states it in full with the port. The caller is never told which check failed.
What does Failed mean?
Failed means the caller was allowed and the device could not serve it. The usual cause is the device's local service not listening on that port.
Why does an entry say it covers many sessions?
Past 60 short sessions an hour from one identity, address and port, sessions are summed into one entry per minute. The entry states the count, so a summary is never read as one session.
Can I export the whole log?
Yes, as CSV. Export CSV downloads every entry matching your filters, up to 100,000 rows. On plans with the team audit log, each export is recorded there.
Who can see the access log?
Admins and owners. Every entry carries a source address. Members with the developer role see who has access on a fleet's Access tab.
What is the difference between the access log and the audit log?
The access log records who connected to which device. The team audit log records who changed the configuration, such as writing a grant or revoking a certificate.
What to read next#
- Grants and Access - the policy the log is evidence for
- Certificates - the identities that appear in it
- Fleets - the devices being reached
- Remote Access - how the pieces fit together
- Member Access - why each person signs in as themselves