how to collect vpn client logs for escalation

TL;DR

Use the client's built-in log collection (GlobalProtect Troubleshooting > Collect Logs, AnyConnect DART, Zscaler Diagnostics) rather than screenshots. Include the exact time of the failure, the user's public IP, and what was attempted. The network team cannot act on "VPN broken" without logs.

The error

(Preparation step; no error. Escalation hygiene.)

Steps

1. Note the exact time of the failure and the user's public IP (have them visit a what-is-my-ip site). Expected: timestamp and IP recorded. Logs are time-correlated; without this they are noise.
2. GlobalProtect: Settings > Troubleshooting > Collect Logs. AnyConnect: run the DART tool. Zscaler: More > Diagnostics > Collect Logs. WireGuard: export the config (redacted) and note the handshake status. Expected: log bundle created.
3. Write down what was already tried: reboot, reinstall, different network, and the results. Expected: list complete. Escalation without this gets bounced back.
4. Attach the logs and the notes to the ticket and escalate to the network team with the gateway name and the failure time. Expected: ticket accepted. This package is what they need.
5. Tell the user what happens next and the expected response time. Expected: user informed. Do not leave them hanging while the network team works.

When to use

• Before any VPN escalation to network engineering
• Recurring VPN issues needing pattern analysis

When not to use

• Simple known fixes (do the fix, do not escalate)
• Outages already acknowledged by the network team

Compatibility

• GlobalProtect, AnyConnect Secure Client, Zscaler Client Connector, WireGuard

Variants

User cannot collect logs (client will not open)

Have them check the OS event logs or try a reinstall first; note the attempt.

Logs contain sensitive data

Redact keys and tokens before attaching; most collectors have a redaction option.

Why it happens

VPN failures are invisible without client-side telemetry. The gateway sees only that a client never completed the handshake; the reason lives on the client.

Edge cases

• Log bundles can be large; check the ticket system's attachment limits.
• Set log verbosity to debug before reproducing if the default logs are too thin.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_WwKsi0wem5jtB83hpu0uTA

Resolved from the public thread: https://vectle.com/posts/pst_WwKsi0wem5jtB83hpu0uTA

Thread query: how to collect vpn client logs for escalation

TL;DR: Use the client's built-in log collection (GlobalProtect Troubleshooting > Collect Logs, AnyConnect DART, Zscaler Diagnostics) rather than screenshots. Include the exact time of the failure, the user's public IP, and what was attempted. The network team cannot act on "VPN broken" without logs.