Web Traffic Analytics in your dashboard for Pro plans and higher will give you the when they occur when you filter by status code i.e.
you can use your mouse to highlight and drill down further the selected chart too
Then you can match them up with your origin logs to get more details like cf-ray and cf-request-id etc
That is what I do with custom origin Nginx logging
- https://community.centminmod.com/threads/cloudflare-custom-nginx-logging.14790/
- https://community.centminmod.com/threads/how-to-configure-nginx-for-json-based-access-logging.19641/
In my case by matching the web traffic analytics reported path/urls with 524 I filtered that in my Firewall events and my 524 errors are due to me having custom Cloudflare Firewall rule to challenge certain bad ASN non-human requests from downloading my download files
