some file

Reverse Proxy Access Logs

NetBird logs every request that passes through your reverse proxy services. Access logs provide visibility into who is accessing your services, from where, and whether requests were allowed or denied. This is useful for auditing, debugging, and monitoring traffic to your publicly exposed services.

Viewing access logs

Access logs are available in the NetBird dashboard under Activity > Proxy Events. This view displays a table of all HTTP requests that have passed through your reverse proxy services, with filters to narrow down results by time range, status, or other fields.

Proxy Events table showing reverse proxy access log entries

You can also retrieve access logs programmatically using the API:

GET /api/events/proxy

What access logs capture

Each log entry records the following information about an HTTP request:

FieldDescription
TimestampWhen the request occurred
MethodHTTP method (GET, POST, PUT, DELETE, etc.)
HostThe domain the request was made to
PathThe URL path requested
Status CodeHTTP status code returned (200, 401, 403, 500, etc.)
DurationHow long the request took (in milliseconds)
Source IPThe client's IP address
Auth MethodWhich authentication method was used (SSO, password, PIN, or none)
User IDThe authenticated user's ID (if SSO was used)
CountryCountry of origin based on source IP geolocation
CityCity of origin based on source IP geolocation
ReasonReason for denial (if applicable)

Understanding log entries

Log entries fall into three categories based on the HTTP status code returned:

  • Allowed requests - Successful requests show a 2xx status code along with the authentication method used to access the service.
  • Denied requests - Failed authentication attempts show 401 or 403 status codes with a reason explaining why the request was denied, such as an invalid password or missing SSO session.
  • Errors - Backend errors or proxy issues show 5xx status codes. These typically indicate that the target service is unreachable or returned an error.

Use cases

Access logs support several operational and security workflows:

  • Security auditing - Review who accessed sensitive services, which authentication method they used, and from which geographic locations. This helps identify unauthorized access attempts and verify that authentication policies are working as expected.
  • Debugging - Trace failed requests to understand authentication or routing issues. The status code, duration, and reason fields help pinpoint whether problems originate from authentication configuration, target availability, or network connectivity.
  • Monitoring - Track usage patterns across your services. Identify which services receive the most traffic, peak usage times, and unusual access patterns that may warrant investigation.
  • Compliance - Maintain records of service access for regulatory requirements. Access logs provide an auditable trail of who accessed what, when, and from where.