diff --git a/Demo/Demo/iOS/OpenVPNViewController.swift b/Demo/Demo/iOS/OpenVPNViewController.swift
index 75327da..9f06d9d 100644
--- a/Demo/Demo/iOS/OpenVPNViewController.swift
+++ b/Demo/Demo/iOS/OpenVPNViewController.swift
@@ -147,7 +147,10 @@ class OpenVPNViewController: UIViewController {
         guard let cfg = cfg else {
             return
         }
-        textLog.text = cfg.debugLog
+        guard let url = cfg.urlForDebugLog else {
+            return
+        }
+        textLog.text = try? String(contentsOf: url)
     }
     
     func updateButton() {
diff --git a/Sources/TunnelKitOpenVPNAppExtension/OpenVPNTunnelProvider.swift b/Sources/TunnelKitOpenVPNAppExtension/OpenVPNTunnelProvider.swift
index 6e7337c..9dfd03d 100644
--- a/Sources/TunnelKitOpenVPNAppExtension/OpenVPNTunnelProvider.swift
+++ b/Sources/TunnelKitOpenVPNAppExtension/OpenVPNTunnelProvider.swift
@@ -100,8 +100,6 @@ open class OpenVPNTunnelProvider: NEPacketTunnelProvider {
     
     // MARK: Constants
     
-    private var logFile: FileDestination?
-    
     private let tunnelQueue = DispatchQueue(label: OpenVPNTunnelProvider.description(), qos: .utility)
     
     private let prngSeedLength = 64
@@ -823,13 +821,14 @@ extension OpenVPNTunnelProvider {
             log.addDestination(console)
         }
 
-        let file = FileDestination(logFileURL: cfg.urlForDebugLog)
+        let file = FileDestination(logFileURL: cfg._appexDebugLogURL)
         file.minLevel = logLevel
         file.format = logFormat
         file.logFileMaxSize = maxLogSize
         log.addDestination(file)
 
-        logFile = file
+        // store path for clients
+        cfg._appexSetDebugLogPath()
     }
     
     private func flushLog() {
diff --git a/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift b/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
index 54f18ed..ffab605 100644
--- a/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
+++ b/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
@@ -37,11 +37,9 @@ extension OpenVPN {
 
     /// Specific configuration for OpenVPN.
     public struct ProviderConfiguration: Codable {
-        fileprivate enum Filenames: String {
-            case debugLog = "OpenVPN.Tunnel.log"
-        }
-        
         fileprivate enum Keys: String {
+            case logPath = "OpenVPN.LogPath"
+
             case dataCount = "OpenVPN.DataCount"
 
             case serverConfiguration = "OpenVPN.ServerConfiguration"
@@ -67,6 +65,9 @@ extension OpenVPN {
         /// Enables debugging.
         public var shouldDebug = false
         
+        /// Debug log path.
+        public var debugLogPath: String? = nil
+
         /// Optional debug log format (SwiftyBeaver format).
         public var debugLogFormat: String? = nil
         
@@ -147,16 +148,9 @@ extension OpenVPN.ProviderConfiguration {
      The URL of the latest debug log.
      */
     public var urlForDebugLog: URL? {
-        return FileManager.default.openVPNURLForDebugLog(appGroup: appGroup)
+        return defaults?.openVPNURLForDebugLog(appGroup: appGroup)
     }
 
-    /**
-     The content of the latest debug log.
-     */
-    public var debugLog: String? {
-        return FileManager.default.openVPNDebugLog(appGroup: appGroup)
-    }
-    
     private var defaults: UserDefaults? {
         return UserDefaults(suiteName: appGroup)
     }
@@ -175,10 +169,30 @@ extension OpenVPN.ProviderConfiguration {
     public func _appexSetLastError(_ newValue: OpenVPNProviderError?) {
         defaults?.openVPNLastError = newValue
     }
+
+    public var _appexDebugLogURL: URL? {
+        guard let path = debugLogPath else {
+            return nil
+        }
+        return FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroup)?
+            .appendingPathComponent(path)
+    }
+
+    public func _appexSetDebugLogPath() {
+        defaults?.setValue(debugLogPath, forKey: OpenVPN.ProviderConfiguration.Keys.logPath.rawValue)
+    }
 }
 
 /// :nodoc:
 extension UserDefaults {
+    public func openVPNURLForDebugLog(appGroup: String) -> URL? {
+        guard let path = string(forKey: OpenVPN.ProviderConfiguration.Keys.logPath.rawValue) else {
+            return nil
+        }
+        return FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroup)?
+            .appendingPathComponent(path)
+    }
+
     public fileprivate(set) var openVPNDataCount: DataCount? {
         get {
             guard let rawValue = openVPNDataCountArray else {
@@ -255,27 +269,3 @@ extension UserDefaults {
         }
     }
 }
-
-/// :nodoc:
-extension FileManager {
-    public func openVPNURLForDebugLog(appGroup: String) -> URL? {
-        return documentsURL(appGroup: appGroup)?
-            .appendingPathComponent(OpenVPN.ProviderConfiguration.Filenames.debugLog.rawValue)
-    }
-
-    public func openVPNDebugLog(appGroup: String) -> String? {
-        guard let url = openVPNURLForDebugLog(appGroup: appGroup) else {
-            return nil
-        }
-        do {
-            return try String(contentsOf: url)
-        } catch {
-            log.error("Unable to access debug log: \(error)")
-            return nil
-        }
-    }
-
-    private func documentsURL(appGroup: String) -> URL? {
-        return containerURL(forSecurityApplicationGroupIdentifier: appGroup)
-    }
-}
diff --git a/Sources/TunnelKitWireGuardAppExtension/WireGuardTunnelProvider.swift b/Sources/TunnelKitWireGuardAppExtension/WireGuardTunnelProvider.swift
index b2671c2..038c042 100644
--- a/Sources/TunnelKitWireGuardAppExtension/WireGuardTunnelProvider.swift
+++ b/Sources/TunnelKitWireGuardAppExtension/WireGuardTunnelProvider.swift
@@ -137,11 +137,14 @@ extension WireGuardTunnelProvider {
             SwiftyBeaver.addDestination(console)
         }
 
-        let file = FileDestination(logFileURL: cfg.urlForDebugLog)
+        let file = FileDestination(logFileURL: cfg._appexDebugLogURL)
         file.minLevel = logLevel
         file.format = logFormat
         file.logFileMaxSize = 20000
         SwiftyBeaver.addDestination(file)
+
+        // store path for clients
+        cfg._appexSetDebugLogPath()
     }
 }
 
diff --git a/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift b/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
index e34671b..d025b61 100644
--- a/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
+++ b/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
@@ -28,8 +28,8 @@ import NetworkExtension
 import TunnelKitManager
 import TunnelKitWireGuardCore
 import WireGuardKit
-import __TunnelKitUtils
 import SwiftyBeaver
+import __TunnelKitUtils
 
 private let log = SwiftyBeaver.self
 
@@ -37,11 +37,9 @@ extension WireGuard {
 
     /// Specific configuration for WireGuard.
     public struct ProviderConfiguration: Codable {
-        fileprivate enum Filenames: String {
-            case debugLog = "WireGuard.Tunnel.log"
-        }
-
         fileprivate enum Keys: String {
+            case logPath = "WireGuard.LogPath"
+
             case lastError = "WireGuard.LastError"
         }
         
@@ -53,6 +51,8 @@ extension WireGuard {
 
         public var shouldDebug = false
 
+        public var debugLogPath: String? = nil
+
         public var debugLogFormat: String? = nil
 
         public init(_ title: String, appGroup: String, configuration: WireGuard.Configuration) {
@@ -95,16 +95,13 @@ extension WireGuard.ProviderConfiguration {
         return defaults?.wireGuardLastError
     }
     
-    private var defaults: UserDefaults? {
-        return UserDefaults(suiteName: appGroup)
-    }
 
     public var urlForDebugLog: URL? {
-        return FileManager.default.wireGuardURLForDebugLog(appGroup: appGroup)
+        return defaults?.wireGuardURLForDebugLog(appGroup: appGroup)
     }
 
-    public var debugLog: String? {
-        return FileManager.default.wireGuardDebugLog(appGroup: appGroup)
+    private var defaults: UserDefaults? {
+        return UserDefaults(suiteName: appGroup)
     }
 }
 
@@ -113,10 +110,30 @@ extension WireGuard.ProviderConfiguration {
     public func _appexSetLastError(_ newValue: WireGuardProviderError?) {
         defaults?.wireGuardLastError = newValue
     }
+
+    public var _appexDebugLogURL: URL? {
+        guard let path = debugLogPath else {
+            return nil
+        }
+        return FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroup)?
+            .appendingPathComponent(path)
+    }
+
+    public func _appexSetDebugLogPath() {
+        defaults?.setValue(debugLogPath, forKey: WireGuard.ProviderConfiguration.Keys.logPath.rawValue)
+    }
 }
 
 /// :nodoc:
 extension UserDefaults {
+    public func wireGuardURLForDebugLog(appGroup: String) -> URL? {
+        guard let path = string(forKey: WireGuard.ProviderConfiguration.Keys.logPath.rawValue) else {
+            return nil
+        }
+        return FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroup)?
+            .appendingPathComponent(path)
+    }
+
     public fileprivate(set) var wireGuardLastError: WireGuardProviderError? {
         get {
             guard let rawValue = string(forKey: WireGuard.ProviderConfiguration.Keys.lastError.rawValue) else {
@@ -133,27 +150,3 @@ extension UserDefaults {
         }
     }
 }
-
-/// :nodoc:
-extension FileManager {
-    public func wireGuardURLForDebugLog(appGroup: String) -> URL? {
-        return documentsURL(appGroup: appGroup)?
-            .appendingPathComponent(WireGuard.ProviderConfiguration.Filenames.debugLog.rawValue)
-    }
-
-    public func wireGuardDebugLog(appGroup: String) -> String? {
-        guard let url = wireGuardURLForDebugLog(appGroup: appGroup) else {
-            return nil
-        }
-        do {
-            return try String(contentsOf: url)
-        } catch {
-            log.error("Unable to access debug log: \(error)")
-            return nil
-        }
-    }
-
-    private func documentsURL(appGroup: String) -> URL? {
-        return containerURL(forSecurityApplicationGroupIdentifier: appGroup)
-    }
-}