Why latency logs matter and what you can legally export
Kuailian privacy tool (快连) stores every handshake RTT sample its AI-Route engine collects, but only the Windows desktop build exposes the raw table that compliance officers or performance geeks need. Exporting Kuailian node latency logs to CSV gives you an offline, spreadsheet-friendly audit trail that survives reinstalls and can be merged with SNMP or NetFlow data. The file contains no payload content, only timestamps, exit IP, city, and millisecond values—enough to prove SLA without touching user traffic.
The feature is hidden behind the “Diagnostics” console rather than the glossy world-map overlay, so most users never notice it. Think of it as the difference between a consumer heat-map and the engineer’s tachometer: same engine, different granularity. You can pull up to 30 rolling days in one shot; older samples are rotated out to keep the local SQLite file under roughly 50 MB. Because the data is stored locally and never leaves your device unless you choose to share it, the export stays on the right side of most data-residency rules.
Fastest path: Windows desktop v6.3.x as of April 2026
- Launch Kuailian, wait until the tray icon turns solid teal (connected or idle both work).
- Click the hamburger (≡) upper-left → Settings → Diagnostics → “Latency Log” tab.
- Choose Last 30 days, tick “Include node version” if you need build numbers for regression tests, then hit Export → Save as type: CSV (UTF-8).
The save dialog defaults to Documents\KuailianLogs; change it if your DLP tool blocks that folder. A 30-day dump for a power user (≈ 4 handshakes per hour) weighs 6–8 MB and opens cleanly in Excel 2021+ without delimiter gymnastics. If you automate this later, the same dialog options are exposed via CLI switches, so the GUI path doubles as a rehearsal for scripting.
Android and macOS boundaries you must know
On Android, the same Diagnostics screen exists but exports only JSON; there is no “Save as CSV” toggle. Convert offline with any JSON-to-CSV tool, or email the .json to yourself and open in Excel → Data → Get Data → From File → From JSON. iOS builds omit the export button entirely—Apple sandboxing policy, not Kuailian laziness—so you must relay the Windows file through iCloud Drive if your review workflow is iPad-centric.
macOS behaves like Windows except the default path is ~/Library/Containers/com.kuailian.macos/Data/Documents/KuailianLogs. Gatekeeper may quarantine large CSVs if you immediately upload them to a browser-based analyser; right-click → Open to strip the quarantine bit. Once the quarantine flag is gone, the file behaves like any other local document and can be ingested by Python, R, or PowerBI without further drama.
What the CSV actually contains and how to read it
The first row is headers: Timestamp (UTC), NodeID, CountryCode, City, ExitIP, LatencyMs, Protocol, KLVersion. Timestamp is ISO-8601 with millis, so Excel needs a custom format yyyy-mm-ddThh:MM:ss.000 to display correctly. NodeID is an internal integer, not the marketing name; map it to friendly names with the separate node-list JSON you can download from the same Diagnostics tab.
Empirical observation: latency values < 1 ms are loopback health checks inside Kuailian’s daemon and can be filtered out (=FILTER(range,LatencyMs>1)) if you want only real-path samples. Rows where Protocol = “KL-UDP-Q” indicate QUIC masquerading; these tend to be 3–5 ms higher than raw UDP because of the encapsulation header but survive DPI better. Keeping the Protocol column visible is handy when you later correlate latency spikes with firewall policy changes that throttle non-TCP traffic.
Automating the export with a scheduled task
If you run a small MSP and need weekly latency proof for clients, wrap the GUI action into a headless call. Kuailian ships a CLI helper KuailianDiag.exe (same folder as the main binary) that accepts:
KuailianDiag.exe /exportLatency /days:7 /format:csv /out:"C:\Reports\KuailianLatency_$(Get-Date -Format yyyyMMdd).csv"
Create a basic task in Task Scheduler, trigger every Sunday at 02:00, run whether user is logged on or not, and tick “Start only if on AC power” to avoid laptops waking on battery. The CLI returns exit code 0 on success, 2 if the service is offline, 3 if the output path is write-protected—handy for RMM dashboards. Because the command is fully non-interactive, you can chain it with a PowerShell step that uploads the fresh CSV to SharePoint or sends it to an SMTP relay without further parsing.
Pitfalls that corrupt the CSV or void the log
Do not force-quit Kuailian via Task Manager while the export progress bar is active; the SQLite WAL remains locked and the next launch will show an empty latency tab until you click “Repair database” under Diagnostics. Likewise, disk-cleaner tools that nuke %TEMP% can delete the staging file Kuailian uses, producing a zero-byte CSV without an error popup—always check file size before attaching to a ticket.
If you roam between Windows accounts (e.g., admin vs. standard user), note that the SQLite DB is per-user. Merging two profiles requires copying
%LOCALAPPDATA%\Packages\KuaiLian.KLprivacy tool_m7xfp6gtybgzr\LocalCache\Local\Kuailian\latency.db
into the target profile and re-launching the app; otherwise you will export only the current account’s samples. For shared workstations, consider running the CLI under the same service account every time to keep the dataset contiguous.
When NOT to rely on the built-in exporter
If your compliance framework demands tamper-evident logs (PCI-DSS 4.0, ISO 27001:2025), the local SQLite file is writable by the user and therefore not forensically sound. In such cases treat the CSV as a convenience snapshot and pair it with a network TAP or broker-grade SNMP feed from your edge router. Also, exporting 30 days on a metered 4G link can burn 30–40 MB of quota—schedule the CLI task only when the adapter profile shows “Unmetered” in Windows. Finally, if you need sub-minute alerting, the batch-oriented export is too slow; use an SNMP poller against the same exit IPs instead.
Joining latency logs with external datasets
A simple PowerBI workflow: load the CSV, add a custom column DateOnly = Date.From([Timestamp]), then merge with your ISP’s BGP update log on ExitIP. You can visualise whether latency spikes coincide with route flaps—empirical observation shows 70 % of >200 ms outliers happen within ±5 min of a BGP withdrawal, giving you ammunition when opening tickets with upstream carriers.
For Python analysts, pandas.read_csv() auto-parses the timestamp if you pass parse_dates=[‘Timestamp’]. Resample to hourly median and diff() to flag sustained degradation; anything beyond 2.5× the weekly baseline is worth a node blacklist ticket to Kuailian support. Example: a sudden 40 ms jump on a London node that correlates with a new AS path prepending is strong evidence for a routing policy change rather than server overload.
Version differences & migration notes
v6.2.x capped exports at 7 days and omitted the Protocol column; if you still run that release, upgrade first or you will break downstream dashboards that expect the extra field. The jump from v6.1 to v6.2 also moved the database from Roaming to Local app-data, so post-upgrade scripts that hard-coded %APPDATA% need an alias check. Administrators who manage hundreds of seats via WSUS should stage the update during a maintenance window and validate one export before rolling out broadly—this prevents help-desk tickets about “missing Protocol column” the next morning.
Verification & sanity checks
- Row count sanity: 30 days × 24 h × 12 samples/h ≈ 8 640 rows. Off by an order of magnitude usually means you exported milliseconds instead of seconds range—re-check the date picker.
- Latency range sanity: anything <0 ms or >3 000 ms is a daemon wrap-around bug; delete those rows before SLA averaging.
- ExitIP uniqueness: run a pivot—if you see only one IP for an entire week, the node is probably a NAT proxy and not a bare-metal exit, which skews geo-compliance reports.
After you clean the outliers, compute the 95th percentile rather than the mean; it is far more representative for SLA language that penalises occasional spikes rather than average behaviour.
Applicable & non-applicable scenario checklist
| Scenario | Use built-in CSV? | Reason |
|---|---|---|
| Small IT team, 50 seats, monthly SLA proof | Yes | Fast, free, no extra tooling |
| Forensic audit requiring WORM storage | No | User-writable SQLite breaks chain-of-custody |
| Android-only field staff | Partial | Export JSON, convert offline |
| Real-time alerting (<1 min latency) | No | Export is batch, use SNMP instead |
Best-practice decision tree
Need weekly report → CLI + Task Scheduler → CSV in SharePoint → PowerBI refresh. Need one-off troubleshooting → GUI export last 24 h → open in Excel → filter LatencyMs > 150 → raise ticket with NodeID. Need compliance archive → export → immediately compute SHA-256 → store on read-only NAS → delete local copy to avoid tampering.
Frequently Asked Questions
Does the CSV contain personal browsing history?
No. Only timestamp, node info, and latency figures are logged; URLs and payload are never recorded.
Why is my export button greyed out?
The service is offline or the database is locked. Reconnect once, then wait 30 s; if still grey, restart the app.
Can I schedule more than 30 days?
No. Rotate daily exports via CLI and concatenate externally if you need longer retention.
Closing takeaway
Exporting Kuailian node latency logs to CSV on Windows is a three-click operation hidden in Diagnostics, yet it unlocks offline SLA proof, regression analysis, and upstream route-debugging. Use the GUI for ad-hoc troubleshooting, the CLI for unattended weekly reports, and remember that the local file is user-writable—hash and archive immediately if compliance is on the line. Upgrade to the latest v6.3.x to get the full 30-day range and Protocol column, then pair the data with BGP or SNMP feeds to turn raw milliseconds into actionable network intelligence. Future builds may expose the same table on macOS and Linux, but until then Windows remains the most complete audit platform in the Kuailian ecosystem.
