ZCC logs are a goldmine, but hard work to read
When a user reports that an application is unreachable or sign-in keeps hanging, the answer is often already in the logs of the Zscaler Client Connector (ZCC). Several components log in parallel there: tunnel establishment, service state, updates and further processes are spread across files such as ZSATunnel.log, ZSAService.log or ZSAUpm.log.
That is exactly what makes manual analysis tedious. An exported log bundle contains many files, rotated archives and tens of thousands of lines. The relevant patterns are cryptic, span multiple files and have to be correlated in time. In everyday help desk work there is rarely time for that, and the experience of knowing which line points to which cause is unevenly distributed.
Path 1: upload the log bundle and let it be evaluated
Log Analyzer in CentaurNexus takes over this step. The upload workflow:
- The user exports the logs in ZCC via the gear icon, then About, then Export Logs or Collect Logs.
- The exported ZIP is uploaded directly to Log Analyzer. It is unpacked locally in the browser; only the contained .log and .txt files are taken over. Alternatively, individual files such as ZSATunnel.log or ZSAService.log can be uploaded.
- The analysis runs automatically and returns severity-sorted findings from critical to low.
- Each finding shows hit count, first and last occurrence, affected files, sample lines and a concrete fix recommendation.
In addition, an overview summarizes the bundle metadata: ZCC version, operating system, Z-Tunnel version, covered time range and the counters for errors and warnings. That makes clear at a glance which client state and time window the analysis covers.
Which failure patterns are detected
The analysis looks for known patterns and assigns them to categories, among others: authentication loops and login failures, disrupted Z-Tunnel connections, failed DNS resolution, PAC file errors, unmet device posture, SSL and certificate errors, local AV or firewall blocking of the ZPA loopback packets, detected captive portals and stuck ZCC upgrades.
Each category comes with a recommendation naming the next verification step: IdP and SAML configuration including system time for authentication loops, the network path to the Service Edge for tunnel disruptions, or the trust store chain for certificate errors. The operator does not start at line one, but at the most likely lever.
Path 2: with CentaurNexusAgent, export and upload disappear
On devices running CentaurNexusAgent, the same process works without user action. CentaurNexusAgent evaluates the ZCC logs directly on the device and transmits structured findings only. No export, no ZIP, no upload, no waiting in the ticket.
When an authorized operator opens the affected user in the Unified Support Center, the client log findings appear inline, in the same findings view as in the upload path. Each finding carries its time window plus first and last occurrence; even a disruption that happened hours ago remains traceable without the user having to reproduce it. One click opens the same findings in the full Log Analyzer view.
Privacy in both workflows
The upload path is also designed for data economy: logs are analyzed in memory only and are not stored. Personal data in sample lines is obfuscated according to the tenant setting, and every retrieval is audited.
Access to findings is role-gated. It is granted only to those allowed to use Log Analyzer or a support center, and an administrator scoped to domains sees only users of their own domains. Log analysis thus remains a controlled workflow and does not become a side entrance to broad inspection rights.
Zscaler remains the core provider
The Zscaler Client Connector remains the authoritative client software and the source of the log data. CentaurNexus adds evaluation, classification and fix recommendations to the supported workflow in a shared work context for help desk and administration. The findings deliberately point back to the Zscaler side of the problem, such as posture profiles, PAC files or the tunnel configuration, so the correction happens where it belongs.
Frequently asked questions
Do I have to unzip the ZCC log bundle before uploading?
No. The exported ZIP can be uploaded directly and is unpacked locally in the browser. Alternatively, individual .log or .txt files can be uploaded.
Do raw logs leave the device when CentaurNexusAgent evaluates them?
No. CentaurNexusAgent evaluates the logs on the device and transmits structured findings only. Raw excerpts stay on the device.
Which failure patterns does the analysis detect?
Among others: authentication loops, disrupted Z-Tunnel connections, DNS and PAC errors, unmet device posture, SSL and certificate errors, blocked ZPA loopback packets, captive portals and stuck ZCC upgrades.
See the workflow in context
Choose the relevant role in the demo launcher. The demo uses prepared sample data.
Open demo launcher