Cloudflare insights

Significant volumes of unencrypted HTTP traffic (SSL/TLS not used) expose data to interception and indicate incomplete HTTPS enforcement or misconfigured SSL/TLS settings.

Cloudflare Tunnels in Degraded status have lost at least one of four redundant connections to the Cloudflare network. Further connection loss risks complete tunnel failure and service interruption.

The cloudflared daemon consuming excessive CPU, memory, goroutines, or file descriptors can lead to connection instability, request timeouts, and tunnel failures.

Cloudflare Tunnel status of 'Degraded' means at least one connection has failed. This reduces redundancy and risks full tunnel outage if additional connections fail.

Unbounded growth in cloudflared_memory_size or cloudflared_open_files indicates potential resource leaks that will eventually cause cloudflared process failure with 'too many open files' errors.

Low cache hit ratios (requests or bandwidth) signal that traffic is bypassing the Cloudflare edge, increasing origin load and latency. This can indicate misconfigured cache rules, origin cache-control headers overriding Cloudflare settings, or increased uncached traffic patterns.

High Non-2xx Response Ratio Signals Application Issues

Elevated ratios of 4xx/5xx responses indicate application errors, misconfigurations, or failing backends. A sustained ratio above 30% suggests widespread issues requiring immediate investigation.

Low cache hit ratios force more requests to origin servers, increasing latency and origin load. Cloudflare measures both bandwidth and request cache hit ratios.

Elevated rates of 4xx and 5xx responses indicate either user-facing errors or backend failures. A sustained ratio above 30% non-2xx responses warrants investigation.

Elevated QUIC packet loss, increasing RTT, or connection closures indicate network path issues affecting tunnel performance and reliability between cloudflared and Cloudflare edge.

For Cloudflare Tunnels using QUIC protocol, packet loss metrics (quic_client_packets_lost) reveal network path issues that degrade tunnel performance and increase latency before causing full connection failures.

Unhealthy load balancer pools signal that backend origins are failing health monitors, resulting in traffic redirection or complete service unavailability if all pools fail.

Cloudflare Load Balancing monitors origin pool health via periodic health checks. Pool health transitions from healthy to unhealthy trigger automatic failover, but monitoring these transitions reveals infrastructure reliability issues.