Remote log collection for ChromeOS devices

For administrators who manage ChromeOS devices for a business or school.

ChromeOS version 114 or above for Kiosk only devices

ChromeOS version 122 or above for all other devices

If you experience problems with a managed ChromeOS device, you can troubleshoot by capturing additional logs from the Device details page in the Google Admin console. For details, see View ChromeOS device details.

If you have turned on the Device system log upload setting for your organizational unit, devices gather the logs that you select, zip them, and upload them to the Admin console.

You get a notification when the remote log command is completed on the user's device and you can download the files.

Before you begin

The Device system log upload setting must be turned on.
The Export Logs Action admin privilege is needed to request logs.
Only one remote log collection command is carried out at a time to prevent the device from overloading. You have to wait for your initial log collection request to be completed before you can send another request.
Make sure the device for which you are requesting logs is connected to a network to collect and upload logs to the Admin console.
The logs are available to download from the Admin console for 30 days.
Google keeps up to 100 files per device. This limit also includes the automatic files uploads as part of the Device system log upload policy.

Scenarios for remote log collection

Users can see log uploads under chrome://management disclaimers.

Kiosk
- These are public sessions. if there is any personally identifiable data (PII) in the logs for Kiosk sessions it is included in the logs.
Affiliated signed-in user
- PII data is removed by default unless admins request them from the Admin console.
Unaffiliated signed-in user
- All detected PII is removed from the logs before uploading.
Managed guest sessions (MGS)
- Managed Guest Sessions are public sessions, are ephemeral, and have an active profile available during the session.
- All detected PII is removed from the logs before uploading.
Login screen
- The login screen is used for displaying the users on the device and authorizing existing or new users to the device. It is not part of any user session.
- All detected PII is removed from the logs before uploading.
Lock screen
- The lock screen is used to block access to user sessions while the user is away and authorize unlocking upon user return.
- The lock screen is part of the user's session so the user's profile is available there. If the primary user is affiliated, the requested PII is included. If they're not affiliated, all detected PII is removed from the logs before uploading.

Request logs

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
From the Admin console Home page, go to Menu DevicesChromeDevices.
Search for and select the kiosk device that you want to request additional logs for.
On the left, select Export logs.
In the Export system logs page, do the following:
1. (Optional) Select an option to provide any support case information. You can go to the next step and collect logs without having a support case ID or token.
2. Click Continue.
3. From the list, select the logs you want to view.
4. (Optional) Depending on your scenario you might see an additional screen to select Personal data to include.
5. Click Export logs.
Wait for the logs to be collected and uploaded to the Admin console. You will see a green success icon once completed.
Under System Logs, click on the logs you want to download. For details, see System activity and troubleshooting.

Which logs are included in the remote log collection?

The availability of the following data on the device depends on your browser version. Some data listed here might not be available on older versions.

Diagnostic data type	Description
Chrome system information	Fetches internal Chrome logs.
Crash IDs	Extracts the most recent crash IDs (if any) and exports them into crash_report_ids and all_crash_report_ids files. For more details, see Troubleshoot Chrome crashes.
Memory details	Fetches memory usage details and exports them into mem_usage and mem_usage_with_title files.
UI hierarchy	Fetches UI component hierarchy for ChromeOS.
Additional ChromeOS platform logs	Collects log data from various scripts and programs. Creates and exports data into these files: alsa controls, cras, audio_diagnostics, env, disk_usage.
DBus details	Fetches memory usage details of DBus interface. Creates and exports data into these files: dbus_details, dbus_summary.
Device event	Fetches entries for network_event_log and device_event_log.
Intel WiFi NICs debug dump	Fetches debug dump information from Intel Wi-Fi NICs that is produced when those NICs have issues such as firmware crashes for ChromeOS.
Touch events	Fetches touch events, touchscreen, and touchpad logs.
ChromeOS Flex logs	Collects hardware data for ChromeOS Flex devices via cros_healthd calls.
ChromeOS network routes	Collects network routing tables for IPv4 and IPv6.
ChromeOS Shill (Connection Manager) logs	Collects device and service properties from Shill.
Policies	Policies applied for device or user for managed users.
ChromeOS system state and logs	Collects log data from debug daemon. Debug daemon collects log from several system files or runs scripts to collect data.
ChromeOS system logs	Collects the contents of /var/log file that contains the log files of various system files, for example Chrome logs, messages, and bluetooth logs. For more details, see Collect ChromeOS device debug logs.
ChromeOS Chrome user logs	Collects logs from the user's directory on ChromeOS. Contains Chrome logs, sign-in and sign-out times and Google Assistant logs.
ChromeOS Bluetooth	Collects information on whether Bluetooth is enabled on the device.
ChromeOS connected input devices	Fetches the information about connected input devices.
ChromeOS traffic counters	Fetches traffic counters for ChromeOS.
ChromeOS virtual keyboard	Fetches the virtual keyboard details on ChromeOS.
ChromeOS network health	Fetches network health details.
Performance and battery status	Collects performance relevant data like the battery saving mode on the device or the active battery status.
Sign-in state	Fetches sign-in tokens and details.
ChromeOS app service	Collects information from the app service about installed and running apps.

List of PII admins can request

Email address
Google Account ID
Network MAC address
IP address
Device and component serial numbers
Printing IPP address
URLs
Android app information
Removable storage names
Other stable identifiers, for example hashes or UUIDs
EAP Network Authentication Information

Was this helpful?

How can we improve it?