Collect ChromeOS device debug logs

This article is for IT administrators managing ChromeOS devices.

If you experience problems with a managed ChromeOS device, you can troubleshoot using network logs and Log Analyzer. Collect the logs, let the Log Analyzer tool examine them for you, and then review the results to resolve the problem. The logs are also useful if you need to contact support about a problem.

Collect network logs

The logs are stored in the /var/log directory, and you can access them by typing file:///var/log in the browser address bar. For details about how to export the contents of /var/log and all its sub directories into a zipped .tgz file, read How to collect ChromeOS device logs.

Examine the logs with Log Analyzer

Log Analyzer is a log-parser that examines device logs for managed ChromeOS devices.

To examine ChromeOS device debug logs with Log Analyzer:

1. Go to Log Analyzer.
2. Do one of the following:
   • Paste the contents of the debug logs into the box.
   • Upload the log file.
3. From the log source drop-down list, select Chrome OS device log
4. Click Analyze.

When the analysis is complete, Log Analyzer will show that there was nothing to report or display observations extracted from the logs along with explanations. In some cases, the observations may contain links where you can find more information.

Tip: The logs cover the life of a device so try to figure out when the issue happened to make searching the observations easier.

• If you see ieee80211_reasoncode in the Log Analyzer output, check a third-party site, such as the Cisco® Support Community, for details on what these codes mean.
• Enrollment failures often put device management server request codes in the logs. For details on server error codes, see Device management errors.

Read the logs manually

You should only read the logs manually as a last resort. Use Log Analyzer first to troubleshoot a problem. If you decide to examine the device logs yourself, use the information below as a guide.

Debug log file structure

File	Description
file:///var/log/bios_info.txt	The hardware ID and model of the device is at the top of the file and looks like this: vendor | coreboot version | Google_Stout.2817.52.0 release_date | 02/13/2013 size | 1024 KB ro bios version | Google_Stout.2817.52.0 Boot switch status: Recovery button: released Developer mode: not enabled RO firmware: protected Boot reason (0): normal Boot firmware: A Active EC code: RW
file:///var/log/boot.log	Includes information about the boot process.
file:///var/log/eventlog.txt	Shows system events such as when a device was turned on or off.
file:///var/log/messages	Includes messages to and from the kernel.
file:///var/log/net.log	These logs are helpful for issues where devices aren't connecting to the right networks or aren't connecting at all and include: The ability to search for :ERROR: or for the minutes leading up to when an event happened. A timestamp that follows the pattern yyyy-mm-ddThh:mm:ss. Example of net.log The following lines show the device has found an available 2.4 GHz and 5 GHz wireless network: 2014-04-02T12:12:27.407032-04:00 localhost wpa_supplicant[881]: mlan0: freq=2437 MHz 2014-04-02T12:15:02.342071-04:00 localhost wpa_supplicant[815]: mlan0: freq=5220 MHz Later in the logs, there's additional information about the strength of the available connections, including the MAC address of the access point, frequency of the signal, noise and signal levels, and signal-to-noise ratio: 6c:f3:7f:41:3d:50 freq=2412 qual=0 noise=-89* level=-61 snr=28 flags=0xb 6c:f3:7f:41:3d:51 freq=2412 qual=0 noise=-89* level=-62 snr=27 flags=0xb 6c:f3:7f:41:3d:59 freq=5220 qual=0 noise=-92* level=-70 snr=22 flags=0xb 6c:f3:7f:41:3d:58 freq=5220 qual=0 noise=-92* level=-71 snr=21 flags=0xb The logs list the available networks in order of preference, which is helpful if a device isn't connecting to the expected network. A ChromeOS device attempts to select the best available network that meets a certain criteria. In this example, devices were connecting to a 2.4 GHz network instead of a 5 GHz network. The logs show that the ChromeOS device rated the 2.4 GHz network higher based on the signal-to-noise ratio (28/27 over 22/21), so it chose to connect to it instead.
file:///var/log/secure	Contains information about sandboxing.
file:///var/log/tlsdate.log	Shows the sequence of events for checking on the date for updating the system.
file:///var/log/update_engine.log	These logs are useful for issues where devices won't update. They show information about communication between a device and omahaproxy for updates, including the response from the server.
file:///var/log/chrome/Crash Reports	This folder contains information about Chrome crashes, which can be difficult to decipher. See Troubleshoot Chrome crashes for more information. You can find crash report information by browsing to chrome://crashes. The most recent file in the /Chrome folder is named chrome, and older files are denoted with a timestamp. Timestamp format: Timestamps have some high-level operating system and browser rendering messages.
file:///var/log/metrics	Contains log metrics in a simple key=value format for easy parsing.
file:///var/log/power_manager	Contains information about actions performed by the power manager.
file:///var/log/ui	Contains issue records about the user interface or graphics.
file:///var/log/update_engine	Chrome moves older update log files to this folder. The latest update log is named /update_engine.log.
file:///var/log/xorg	Contains hardware and system information.

Collect additional device logs in the Admin console

If you experience problems with a managed ChromeOS device, you can troubleshoot by capturing additional logs from the Device details page in the Google Admin console. For more details, see Remote log collection for ChromeOS devices.