Planning your return to office strategy? See how ChromeOS can help.

Collect ChromeOS device debug logs

This article is for IT administrators managing ChromeOS devices.

If you experience problems with a managed ChromeOS device, you can troubleshoot using network logs and Log Analyzer. Collect the logs, let the Log Analyzer tool examine them for you, and then review the results to resolve the problem. The logs are also useful if you need to contact support about a problem.

Collect network logs

The logs are stored in the /var/log directory, and you can access them by typing file:///var/log in the browser address bar. For details about how to export the contents of /var/log and all its sub directories into a zipped .tgz file, read How to collect ChromeOS device logs.

Examine the logs with Log Analyzer

Log Analyzer is a log-parser that examines device logs for managed ChromeOS devices.

To examine ChromeOS device debug logs with Log Analyzer:

  1. Go to Log Analyzer.
  2. Do one of the following:
    • Paste the contents of the debug logs into the box.
    • Upload the log file.
  3. From the log source drop-down list, select Chrome OS device log
  4. Click Analyze.

When the analysis is complete, Log Analyzer will show that there was nothing to report or display observations extracted from the logs along with explanations. In some cases, the observations may contain links where you can find more information.

Tip: The logs cover the life of a device so try to figure out when the issue happened to make searching the observations easier.

  • If you see ieee80211_reasoncode in the Log Analyzer output, check a third-party site, such as the Cisco® Support Community, for details on what these codes mean.
  • Enrollment failures often put device management server request codes in the logs. For details on server error codes, see Device management errors.
Read the logs manually

You should only read the logs manually as a last resort. Use Log Analyzer first to troubleshoot a problem. If you decide to examine the device logs yourself, use the information below as a guide.

Debug log file structure

File Description

The hardware ID and model of the device is at the top of the file and looks like this:

vendor | coreboot
version | Google_Stout.2817.52.0
release_date | 02/13/2013
size | 1024 KB
ro bios version | Google_Stout.2817.52.0
Boot switch status:
Recovery button: released
Developer mode: not enabled
RO firmware: protected
Boot reason (0): normal
Boot firmware: A
Active EC code: RW

Includes information about the boot process.


Shows system events such as when a device was turned on or off.


Includes messages to and from the kernel.


These logs are helpful for issues where devices aren't connecting to the right networks or aren't connecting at all and include:

  • The ability to search for :ERROR: or for the minutes leading up to when an event happened.
  • A timestamp that follows the pattern yyyy-mm-ddThh:mm:ss.

Example of net.log

The following lines show the device has found an available 2.4 GHz and 5 GHz wireless network:

2014-04-02T12:12:27.407032-04:00 localhost wpa_supplicant[881]: mlan0: freq=2437 MHz
2014-04-02T12:15:02.342071-04:00 localhost wpa_supplicant[815]: mlan0: freq=5220 MHz

Later in the logs, there's additional information about the strength of the available connections, including the MAC address of the access point, frequency of the signal, noise and signal levels, and signal-to-noise ratio:

6c:f3:7f:41:3d:50 freq=2412 qual=0 noise=-89* level=-61 snr=28 flags=0xb
6c:f3:7f:41:3d:51 freq=2412 qual=0 noise=-89* level=-62 snr=27 flags=0xb
6c:f3:7f:41:3d:59 freq=5220 qual=0 noise=-92* level=-70 snr=22 flags=0xb
6c:f3:7f:41:3d:58 freq=5220 qual=0 noise=-92* level=-71 snr=21 flags=0xb

The logs list the available networks in order of preference, which is helpful if a device isn't connecting to the expected network.

A ChromeOS device attempts to select the best available network that meets a certain criteria. In this example, devices were connecting to a 2.4 GHz network instead of a 5 GHz network. The logs show that the ChromeOS device rated the 2.4 GHz network higher based on the signal-to-noise ratio (28/27 over 22/21), so it chose to connect to it instead.


Contains information about sandboxing.


Shows the sequence of events for checking on the date for updating the system.


These logs are useful for issues where devices won't update. They show information about communication between a device and omahaproxy for updates, including the response from the server.

file:///var/log/chrome/Crash Reports

This folder contains information about Chrome crashes, which can be difficult to decipher. See Troubleshoot Chrome crashes for more information. You can find crash report information by browsing to chrome://crashes. The most recent file in the /Chrome folder is named chrome, and older files are denoted with a timestamp.

Timestamp format: Timestamps have some high-level operating system and browser rendering messages.


Contains log metrics in a simple key=value format for easy parsing.


Contains information about actions performed by the power manager.

file:///var/log/ui Contains issue records about the user interface or graphics.
file:///var/log/update_engine Chrome moves older update log files to this folder. The latest update log is named /update_engine.log.
file:///var/log/xorg Contains hardware and system information.

Was this helpful?

How can we improve it?
Clear search
Close search
Google apps
Main menu
Search Help Center