---
title: "Connection Logs: Fields, Results, and Retention"
description: "What each connection log row holds, what results such as denied_by_policy mean, retention per plan, and the logs API with the direction filter."
canonical: https://fixedmark.com/docs/logs
updated: 2026-11-01
source: Fixedmark (https://fixedmark.com), BitMask LLP
---

Manage

# Connection logs

Every connection through your static IPs leaves one log row: when, where to, how many bytes, from which IP, and how it ended. Use the rows to see why an allowlisted API refused you, or which token made a call.

Docs preview: Fixedmark is not live yet. Endpoints are issued at launch, and these pages describe planned launch behavior. Anything marked planned may change. [Join early access](https://fixedmark.com/early-access) to get yours first.

## What a row holds

_Connection log fields_

| Field                    | Meaning                                                                                                                         |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| `at`                     | When the connection closed.                                                                                                     |
| `direction`              | `egress` for outbound traffic, `ingress` for a partner's connection to an [inbound route](https://fixedmark.com/docs/inbound) . |
| `dest_host`, `dest_port` | The destination your client asked for.                                                                                          |
| `sni`                    | The TLS server name, when the client sent one.                                                                                  |
| `bytes_up`, `bytes_down` | Bytes sent and received.                                                                                                        |
| `duration_ms`            | How long the connection was open.                                                                                               |
| `egress_ip`              | The static IP the connection left from.                                                                                         |
| `result`, `reason`       | How it ended. See the results below.                                                                                            |
| `credential_id`          | The id of the proxy credential that opened the connection, never the token.                                                     |

Rows hold metadata only. No request or response content is stored, and TLS traffic is never decrypted.

## Results

_Common connection results_

| Result                                                       | Meaning                                                                                                       |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- |
| `ok`                                                         | The connection opened and closed normally.                                                                    |
| `denied_by_policy`                                           | The credential's [allowlist](https://fixedmark.com/docs/allowlists) does not name the destination.            |
| `probe`                                                      | fm tunnel checked its credentials at startup and closed. No traffic was sent.                                 |
| `auth_failed`                                                | The app id or token was wrong or revoked.                                                                     |
| `upstream_unreachable`, `upstream_timeout`, `upstream_reset` | The destination refused, did not answer, or reset the connection.                                             |
| `smtp_blocked_by_provider`                                   | The destination port is a mail port that is blocked. See [support](https://fixedmark.com/docs/support#mail) . |

## How long rows are kept

_Connection log retention by plan_

| Plan     | Kept for |
| -------- | -------- |
| Starter  | 1 day    |
| Pro      | 7 days   |
| Business | 30 days  |
| Scale    | 30 days  |

Retention follows your current plan. Rows older than it are deleted and cannot be read back.

## Read the logs

Open the app, then Logs, in the dashboard. Or page through rows with the API, newest first:

**Terminal**

```bash
curl "https://api.fixedmark.com/v1/apps/APP_ID/logs?direction=egress&result=denied_by_policy&limit=100" \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY"
```

_Log query parameters_

| Parameter        | Meaning                                                                                                                                |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `since`, `until` | RFC 3339 times. `since` never reaches past your retention.                                                                             |
| `direction`      | `egress` or `ingress`. Inbound rows are `ingress` and appear only on IPs with an [inbound route](https://fixedmark.com/docs/inbound) . |
| `peer`           | An `ingress` row's partner address, or a CIDR such as `198.51.100.0/24`.                                                               |
| `listener_port`  | The inbound port on your IP, such as `20000`.                                                                                          |
| `route_id`       | One inbound route.                                                                                                                     |
| `dest`           | A host, `host:port`, or `*.suffix`.                                                                                                    |
| `result`         | One result, such as `denied_by_policy`.                                                                                                |
| `egress_ip`      | One of your static IPs.                                                                                                                |
| `limit`          | 1 to 1000 rows per page.                                                                                                               |
| `cursor`         | The `next_cursor` of the previous page.                                                                                                |

`GET /v1/apps/{id}/logs/stream` follows new rows as server-sent events with the same filters. Send `Last-Event-ID` to resume after a disconnect. A resumed stream misses no row but can send one again, so skip a row whose `id` you already have. An unknown or repeated parameter answers 400 `logs.bad_query`, and too many open streams answers 503 `logs.busy`.

## Frequently asked questions

### Why do I see a probe row each time fm tunnel starts?

fm checks its credentials when it starts, then closes that connection. The row has result probe and carries no traffic.

### Can I see inbound connections?

Yes, once you have an inbound route. Each partner connection leaves an ingress row with the partner's address, the inbound port, the route, bytes, and how it ended, such as partner_denied for a source outside the route's partner list. Filter with direction=ingress, peer, listener_port, or route_id.