Changes Cloudflare Delayed audit log delivery for WARP and Zero Trust services

Cloudflare: Major incident: Delayed audit log delivery for WARP and Zero Trust services

Major incidentdegradation (model (Jev), 100%)Changed 2026-10-22 17:32 UTCDetected 2026-10-22 17:33 UTCwww.cloudflarestatus.com

Summary

Cloudflare reported a minor degradation affecting WARP API and Zero Trust audit log delivery starting 2026-10-22 17:32 UTC; some customers’ logs were delayed or not delivered, with dependent services potentially affected. A shared internal data pipeline capacity problem in PDX was identified; mitigations partially restored it. The incident remained open when archived, 0 min at the last update.

Machine-written from the diff below (Sol; type: incident degradation). Check the diff before relying on it.

Incident page: the full timeline of updates

What changed

~~Struck in red~~ is what Cloudflare removed; blue is what they added. Muted text is unchanged context.

AddedTitle#1

not present

Delayed audit log delivery for WARP and Zero Trust services

AddedImpact#2

not present

minor

AddedStatus#3

not present

investigating

AddedStart time#4

not present

2026-10-22 17:32 UTC

AddedAffected components#5

not present

Audit Logs, Cloudflare Sites and Services - Audit Logs, Cloudflare Sites and Services - Zero Trust, Zero Trust

AddedUpdateinvestigating2026-10-22 17:32 UTC#6

not present

We are investigating an issue affecting audit log delivery for WARP API. Audit logs for some customers may be delayed or not delivered, and some dependent services may also be affected. We have identified the cause as a capacity problem in a shared internal data pipeline in our PDX region. Mitigations are in place and the pipeline is partially recovered. We are continuing to monitor and work toward full recovery.

First version of this incident archived by Rewindex. View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 22
After captured 17:33 UTC
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on Oct 23, 11:49 UTC. Record hash 81a77f2c1bb87985…
Download proof

History of this incident

Wednesday, October 28

1 incident change

Wording only
14:33Incident
Incident updateDelayed audit log delivery for WARP and Zero Trust services

Friday, October 23

1 incident change

Normal progress
00:13Incident
Incident updateDelayed audit log delivery for WARP and Zero Trust services

Thursday, October 22

1 rewrite, 2 incident changes

Normal progress
17:53Incident
Incident updateDelayed audit log delivery for WARP and Zero Trust services
Minor edit
17:43Edited by the vendor
Delayed audit log delivery for WARP and Zero Trust services
Cloudflare raised the impact level for delayed audit log delivery for WARP and Zero Trust services from minor to major. This edit provides no start time, duration, cause, or fix.
Degradation
17:32Major incident
Delayed audit log delivery for WARP and Zero Trust servicesthis change
Cloudflare reported a minor degradation affecting WARP API and Zero Trust audit log delivery starting 2026-10-22 17:32 UTC; some customers’ logs were delayed or not delivered, with dependent services potentially affected. A shared internal data pipeline capacity problem in PDX was identified; mitigations partially restored it. The incident remained open when archived, 0 min at the last update.

Cite this

Major incident: Delayed audit log delivery for WARP and Zero Trust services on Cloudflare’s status page, changed 2026-10-22 17:32 UTC (change 1 of 5).

Title: Major incident: Delayed audit log delivery for WARP and Zero Trust services
Vendor: Cloudflare
Date: 2026-10-22 17:32 UTC
URL: https://rewindex.com/change/ie408d14a76d276

All Cloudflare changes Cloudflare profile Markdown JSON