Warp-svc fill my server disk with log

Some users had reported but no response
Disable warp-svc debug logs - Developers - Cloudflare Community
1.1.1.1 App on Mac filling up HDD with log file - Zero Trust / 1.1.1.1 - Cloudflare Community
output of sudo ls -lhS /var/log

total 35G
-rw-r-----  1 syslog      adm              22G Sep 28 20:05 syslog
-rw-r-----  1 syslog      adm              13G Sep 17 00:03 syslog.1
-rw-r-----  1 syslog      adm             361M Aug 27 00:04 syslog.4.gz
-rw-rw-r--  1 root        utmp            163M Sep 28 20:02 lastlog
-rw-r-----  1 syslog      adm             140M Sep 10 00:01 syslog.2.gz
-rw-r-----  1 syslog      adm              47M Sep  3 00:06 syslog.3.gz

sudo tail -n 100 /var/log/syslog

all logs are start with warp-svc

It sounds like you need to disable verbose logging. If it’s set to debug, change to info or warning to reduce the noise.

1 Like

Do you mean change /etc/systemd/system.conf LogLevel?
It is default LogLevel=info or change something else?

I’ve not tried this myself, but try etc/warp/warp.toml & look for the ‘log’ or ‘log_level’ section

There is no such file, and the dir /etc/warp/ doesn’t exits either.

The post you linked to is for Macs. What system is this happening on?

1 Like

Ubuntu 22.04 server

Having the same issue.
OS: Ubuntu 22.04.3 LTS x86_64
Kernel: 5.15.0-84-generic
cloudflare-warp version: 2023.3.398-1

I have the same issue.

❯ uname -r
6.2.0-35-generic

❯ sudo apt show cloudflare-warp
Package: cloudflare-warp
Version: 2023.9.301-1

Yeah had the same problem on Mint Victoria (21.2)… warp-svc records in debug mode which is basically every server response imaginable (for troubleshooting). I found nothing to help here, but have been able to minimise the log proliferation as follows:

In /etc/fstab I added the following lines:
tmpfs /var/log/cloudflare-warp tmpfs rw,nodev,nosuid
tmpfs /var/log/journal tmpfs rw,nodev,nosuid

(puts journal and cloudflare logs into ram only, i.e. not written to disk)

In addition, I added the uncommented lines to:
/etc/systemd/journald.conf
#ForwardToSyslog=yes
ForwardToSyslog=no
#MaxLevelStore=debug
MaxLevelStore=3
#MaxLevelSyslog=debug
MaxLevelSyslog=3

MaxLevel…=3 is error and worse only (no info, no debug)
For some reason cloudflare-warp overrides these settings, but none of the other logs do.
The countless logrotate due to incessant warp-svc chatter was causing my system to crash with logrotate unable to write to ro filesystem (unsure of the reason for this, maybe error in nvme drive firmware) while system was under heavy load (handbrake video processing).
If a more permanent journald is required, I would have to remove the tmpfs line for /var/log/journal from the fstab, but I can get by without it for now until Cloudflare fixes this incessant debug chatter!

With these settings, cloudflare chatter no longer clutters /var/log/syslog, and only errors or worse are recorded there.
Cloudflare logs disappear into the ether at system shutdown!