The Linux Diagnostic Tool (nordlayer-diagtool) is a built-in utility that collects system information and logs to help troubleshoot connectivity and configuration issues. It is installed automatically as part of the NordLayer application. When run, it gathers details about your system, the NordLayer application status and settings, and service logs into a single, encrypted report you can share with our support team.
For your privacy, all collected data is encrypted before saving, and you are given the opportunity to review the information before the final file is created.
How to run the diagnostic tool
- Open your Linux terminal.
- Start the utility:
nordlayer-diagtool run
By default the report is saved to /tmp/. To choose a different directory, use the --out flag, for example: nordlayer-diagtool run --out ~/Documents.
3. A welcome screen appears, describing the tool. Press Enter to begin. The tool sequentially collects OS details, verifies your NordLayer status and settings, and exports the logs.
4. When collection finishes, you reach the review screen. From here you can:
- Press Enter to review the collected data before saving, then press Enter again on the review screen to save and quit (or q to cancel).
- Press S to save the report immediately, without reviewing.
Keyboard controls
While using the diagnostic tool, the following keys are available:
- Enter — continue to the next screen / start diagnostics / on the review screen, open the data for review / save and quit.
- S — save the report immediately, skipping the review.
- Up / Down (or k / j, Page Up / Page Down) — scroll through the report details.
- Q, Esc, or Ctrl+C — quit the application.
Understanding the report
After running the diagnostics and saving, an encrypted report is generated in your chosen directory (/tmp/ by default). The filename looks like nordlayer-diagnosis-<random>.json.
This report contains essential troubleshooting data, including:
- System information: OS/distribution version, kernel, uptime, RAM, CPU, and desktop environment details.
- NordLayer service status: whether NordLayer is installed, its version, and whether the service is running and enabled.
- NordLayer settings: your current configuration — preferred VPN protocol, auto-connect, Web Protection, Always On, Kill Switch, and local network access.
- Logs: exported NordLayer service logs from
journalctl(thenordlayerjournal namespace). - Timestamp: the date and time the diagnostics were run.
All reports are encrypted locally on your device before being saved. No data is automatically transmitted over the network — the information is only shared when you explicitly send the file to NordLayer support. Sensitive identifiers such as the machine ID and hostname are stripped from the logs, and any temporary files created during the process are cleaned up automatically when the tool exits.
- When to run: for the most useful data, run the diagnostic tool immediately after you experience a connectivity issue or make a configuration change.
- Reviewing data: you can always review the report in the terminal before saving, to confirm you are comfortable with the collected information.
- Getting help: keep the generated report file handy when contacting NordLayer support so you can attach it to your ticket.
Note: In case you have any questions or are experiencing any issues, please feel free to contact our 24/7 customer support team.