In addition to core and integrated services, Workspace ONE provides logs to troubleshoot your devices running Workspace ONE UEM. Learn more about the types of devices supported, how to change log levels, and what log information is provided by Workspace ONE UEM for your devices.
Explore and implement logging for end-user devices running the Workspace ONE Intelligent Hub. Some logging might require more components or requirements gathering.
iOS Devices
Learn more about the Workspace ONE UEM logging functions available for iOS Devices.
| Method | Log Name | Description |
|---|---|---|
| Console app on macOS | *.txt | Contains information related to all device side transactions including MDM, Enrollment, access, and application run history. |
| Hub App w/ Debug enabled in SDK | Agentlog####.txt | Contains information on system messages and stack traces when devices throw errors that are written from applications with the Log class. |
| Crash Logs | *.crash | Contains information on application crashes that is stored on iOS devices. |
| sysdiagnose | *.tar.gz | Instructions available on Apple developer website. These logs contain information from the past. Issues reproduced in the last few hours are referenced in these logs. |
macOS Devices
Learn more about the Workspace ONE UEM logging functions available for macOS Devices.
| Method | Log Name | Description |
|---|---|---|
| Console.app | *.txt | Contains information related to all device side transactions including MDM, enrollment, access, and application run history. |
| /Library/Logs/DiagnosticReports | Intelligent Hub*.crash & hubd*.crash | Contains information on crashes related to the Hub daemon. |
| Sudo Log collect (/var/log/) | System.log | Contains information on the mdmd and other OS-specific activities. Used only for macOS 10.12+. |
| /var/log/ | Install.log | Contains information on package installations including Munki. |
| /Library/Application Support/AirWatch/Data/Munki/managed installs/logs/ | ManagedSoftwareUpdate.log | Main Munki logging file which contain information pertaining to macOS software deployment through UEM Internal Apps. |
| /Library/Application Support/Airwatch/Data/Munki/munki_repo/munkiData/ | Munki_data.plist | Contains internal metadata information on current software being deployed through UEM Internal Apps. |
| /Library/Preferences/ | AirWatchManagedInstalls.plist | Preference file used for Workspace ONE integration with Munki. |
| /Library/Application Support/AirWatch/Data/Munki/Managed Installs/ | InstallInfo.plist | Contains status information on current software being deployed through UEM Internal Apps. |
| /Library/Application Support/AirWatch/Data/Munki/Managed Installs/ | ManagedInstallReport.plist | Contains detailed status information on current software being deployed through UEM Internal Apps. |
| /Library/Application Support/AirWatch/Data | AppStatuses_WS1.plist | Used for displaying software download and installation statuses within Intelligent Hub. |
| /Library/Application Support/AirWatch/Data/Munki/Munki_Repo/catalogs/device_catalog.plist | device_catalog.plist | Contains metadata information about the internal apps like bundle id, installation criteria, pre/post-install scripts, and so on. |
| /Library/Application Support/AirWatch/Data/Munki/Munki_Repo/manifests/device_manifest.plist | device_manifest.plist | Contains all the assigned apps. |
| /Library/Application Support/AirWatch/Data/VPPApps.plist | VPPApps.plist | Contains information about assigned VPP apps like appurl, name, bundleid, status, and so on. |
| /Library/Application Support/AirWatch/Data/CustomAttributes/CustomAttributes.plist | CustomAttributes.plist | Contains the latest key-value pairs generated by Custom Attribute scripts. Contents in this plist will be sent to UEM in regular Hub samples. |
| /Library/Application Support/AirWatch/Data/com.airwatch.hub.flags.plist | com.airwatch.hub.flags.plist | Status of recently released features in the form of key-value pair. Key is the name of the feature and value can be either True/False. |
| /Library/Application Support/AirWatch/Data/ProductsNew | ProductsNew | Contains information about File/Action Products deployed through UEM Product Provisioning. |
For information about how to collect logs, see Request Device Logs in macOS Device Management.
Android Devices
Learn more about the Workspace ONE UEM logging functions available for Android Devices.
| Method | Log Name | Description |
|---|---|---|
| ADB/Android Studio/RXLogger | *.txt | Contains information on app level traffic such as system messages and stack traces. |
| Hub Debug Logs | *.txt | Contains information on app level traffic such as system messages and stack traces filtered to the Workspace ONE Intelligent Hub and PackageManager. |
| DumpState Logs - Samsung Only | *.txt | Contains information on app level traffic such as system messages and stack traces (logcat) collected without active ADB connection to device and used for historical logging. |
| Bug Report | *.zip | Contains information about the current device state and captures app level traffic such as system messages and stack traces (logcat). In contrast with ADB, Dumpstate captures only the current logcat buffer. |
| Network Logging | *.txt | Captures DNS requests and network connections from apps to a log file for the specified duration. Note: Available on Work Managed devices running Android 8 or later. |
| Security Logging | *.txt | Captures possible security breaches such as pre and post boot activities, authentication attempts, credential storage modification, attempted adb connections, and more. Note: Requires Work Managed Android 7.0 or later devices and Workspace ONE Intelligent Hub 21.05 for Android. |
Android Enterprise Wipe Logs - Android (Legacy)
More logs are available if an Android device in your deployment is enterprise-wiped.
To capture the latest set of logs, tap the Workspace ONE Intelligent Hub welcome screen header on the affected device five times. Selecting share opens any available email app on the device where you can send the logging to administrators or support to help with the investigation. You can also select Copy, which saves a copy of the file on the device's file storage, which can then be easily extracted from the device.
This logging function requires a minimum version of Workspace ONE Intelligent Hub for Android v8.1.
Google Bug Reports
To capture a Google bug report, navigate to Device Settings > Software Information > Build Number and tap Build Number seven times to enable developer options. An option is available under Developer Options > Take Bug Report. After replication of the issue, select this option and allow 1-2 minutes for the report to be generated. When the report generates, a push notification appears that can be opened. From the notification, select how to share the report (Email, Bluetooth, or other method.).
For Work Managed devices, Google bug reports can also be gathered through the Workspace ONE UEM console. Under the device details page navigate to and select More Actions > Request Device Log > Snapshot System. A Google bug report will be generated. The report can be accessed from Device Details > More > Attachments > Documents.
Performance Logging
Explore and implement more logs to troubleshoot and improve your Workspace ONE UEM deployment.
Some logging might require more components or gathering requirements.
| Method/Folder | Log Name | Description |
|---|---|---|
| ADB/Android Studio/RXLogger | *.txt | Contains real time logs for SDK application logging from developer run application. |
| Console app on macOS | *.txt | Contains real time logs for SDK application logging from developer run application. |
| Console (Apps&Book\Analytics\App Logs) | AppLog####.txt | Contains information from third-party SDK application integrations. |
Telecom Service App Reports
To capture a Telecom Service report, open the Telecom service app and tap the screen five times. A notification appears that file logging is enabled. Open the application menu and select Copy Log/DB. Open the native file manager and navigate to Internal Storage > Android > Data > com.airwatch.sampler > Files > telecom-log-dir > #.txt. Transfer this file off of the device for further review.
Linux Devices
Learn more about the Workspace ONE UEM logging functions available for Linux Devices.
| Method/Folder | Log Name | Description |
|---|---|---|
| /var/log/ws1-hub/ | ws1HubAgent.log | Contains information to all device side transactions including MDM commands, profiles, apps and service run history. |
| /var/log/ws1-hub/ | ws1HubEnroll.log | Contains information on device and user enrollment. |
| /var/log/ws1-hub/ | ws1HubPuppetConfig.log | Contains information specific to Puppet install/uninstall. Puppet open source agent is installed and used for custom configuration profiles. |
| /var/log/ws1-hub/ | ws1HubSetup.log | Contains information on Hub installation, upgrades and uninstalls. |
| /var/log/ws1-hub/ | ws1HubUtil.log | Contains information specific to executing the ws1HubUtil command line utility. |
| /var/log/ws1-hub | agent.log | Contains information on hub restart service with systemd. |
| /opt/airwatch/ws1-hub/config/ | LogConfig.json | This file controls the device side logging configuration. By editing this file, you can change the max log file size (in MBs), the number of files to keep, the number of days to retain and the log level. The log levels options are: 1=Error, 2=Warning, 3=Info & 4=Verbose. |
For information about how to collect Linux logs, see Command-line Utilities for Workspace ONE Intelligent Hub on Linux.
Windows Phone Devices - Legacy
Learn more about the Workspace ONE UEM logging functions available for Windows Phone Devices.
| Method | Log Name | Description |
|---|---|---|
| Field Medic | *.etl | Contains information on enrollment and most other MDM related functions. |
Windows Desktop Devices (Windows HUB)
For deployments using the Windows HUB, use Remote Log collection to gather Windows Desktop logs.
-
In the Workspace ONE UEM Device List view, select the device you want to collect logs for.
-
Select More Actions Request Device Log.
-
Select the log source: Hub or System.
-
Hub - logs related to the Workspace ONE Intelligent Hub such as the Hub and application deployment logs
-
System - logs related to the system such as Event Viewer logs and registry export.
-
-
Navigate to More > Attachments > Documents. Select the log name to download the log bundle and view the logs. The logs are contained in a .ZIP folder.
| Method | Log Name | Description |
|---|---|---|
| /Hub/Agents/ApplicationDeploymentAgent/ | RegistryExport.txt | Contains information on application deployment flows. |
| /Hub/Agents/ApplicationDeploymentAgent/ | AirWatchMDM-*.etl | Contains information on application deployment flows. |
| Hub/Agents/WindowsUnifiedAgent/ | AWProcessCommands.log | Contains information around installations that use the agent such as encryption and product provisioning. |
| Hub/Agents/WindowsUnifiedAgent/ | NativeEnrollment.log | Contains information on agent based enrollments. |
| Hub/Agents/WindowsUnifiedAgent/ | PowershellExecute.log | Contains information on PowerShell commands run through product provisioning. |
| Hub/Agents/WindowsUnifiedAgent/ | TaskScheduler.log | Contains information on Task scheduler’s local enforcement of policies, and samples sent to the console. |
| Hub/Agents/WindowsUnifiedAgent/ | AwclClient.log | Contains information on communications between AWCM client and Workspace ONE UEM. |
| Hub/Agents/WindowsUnifiedAgent/ | SSOCommunicationHandler.log | Contains information on agent post-enrollment single sign-on. |
| Hub/Agents/WindowsUnifiedAgent/ | Updater.log | Contains information on agent auto update procedures. |
| Hub/Agents/WindowsUnifiedAgent/ | AwAirWatchlpc.log | Contains communication records between the Workspace ONE app and other services. |
| Hub/Agents/WindowsUnifiedAgent/ | WorkspaceOneProvisioning.log | Contains information on Workspace ONE app installations and downloads. |
| Hub/Agents/ProvisioningAgent/ | awProvAgent.log | Contains the provisioning agent event logging. |
| System/Device/PCRefresh/ | RegistryExport.txt | Contains registry exports related to software and user provisioning. |
| System/Device/PCRefresh/ or C:\Recovery\OEM\AirWatch\ | * | Contains logs and application data with the app deployment cache, Hub database with all configurations and settings, and registry settings with MDM device ID. |
| System/Device/Windows/ | Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provided_Admin_EventLogs.evtx | Contains information on MDM event logs. |
| System/Device/Windows/ | System_EventLogs.evtx | Contains information on system Event Logs. |
| System/Device/Windows | RegistryExport.txt | Contains a list of successfully applies CSPs on the device (profiles and apps). |
| System/Device/Windows/Environment/ | Processes.txt | Contains a list of currently running processes. |
| System/Device/Windows/Environment/ | Services.txt | Contains a list of currently registered services. |
With Intelligent Hub for Windows, large log files are automatically split into segments when requested from the console. For information on recombining those segments to enable remote troubleshooting, see [Using Spanned Logs When Troubleshooting Intelligent Hub for Windows.
Windows Desktop Devices (Without Windows HUB)
If your deployment does not include the Windows HUB, use the following Windows Desktop logging options.
| Method | Log Name | Description |
|---|---|---|
| Windows Event Viewer | *.evtx | Contains information on enrollment using Work Access and MDM functions that do not require the Unified Agent (Samples, Profiles, Commands). |
| /AirWatch/UnifiedAgent/Logs/ | AwprocessCommands.Log | Contains information on installs that use the Unified Agent such as encryption and product provisioning. |
| /AirWatch/UnifiedAgent/Logs/ | AWLPC.Log | Contains information related to the communications between the Unified Agent and AirWatch. |
| /AirWatch/UnifiedAgent/Logs/ | DeemInstaller.log | Contains logs related to osquery and the telemetry agent on the device. Also, shows the results of the osquery data being sent to Workspace ONE Intelligence and any errors. |
| /AirWatch/UnifiedAgent/Logs/ | DSM.log | Contains info regarding device state management. |
| /AirWatch/UnifiedAgent/Logs/ | NativeEnrollment.log | Contains information around the Workspace ONE Intelligent Hub-Based enrollment method. |
| /AirWatch/UnifiedAgent/Logs/ | PowershellExecute.log | Contains information on PowerShell commands that are run through product provisioning. |
| /AirWatch/UnifiedAgent/Logs/ | AwclClient.log | Contains information on communications between AWCM client and AirWatch. |
| /AirWatch/UnifiedAgent/Logs/ | TaskScheduler.log | Contains information on the Task Scheduler’s local enforcement of policies. |
| /AirWatch/UnifiedAgent/Logs/ | SSOCommunicationHandler.log | Contains information on post enrollment SSO for Workspace ONE Intelligent Hub. |
| /AirWatch/UnifiedAgent/Logs/ | RMService.log | Contains information around the Workspace ONE Intelligent Hub-Based enrollment method. |
| /AirWatch/UnifiedAgent/Logs/ | Workflow.log | Contains information for Workspace ONE Workflows execution. |
Windows Rugged Devices
Learn more about the Workspace ONE UEM logging functions available forWindows Rugged Devices.
| Method | Log Name | Description |
|---|---|---|
| /AirWatch/Logs | Awregisterdevice | Contains information on device registration that occurs during the enrollment process. |
| /AirWatch/Logs | AWService.log | Contains information on communications between the device and AirWatch including managed beacon and interrogator samples. |
| /AirWatch/Logs | AWApplicationManager.log | Contains information related to product provisioning. |
| /AirWatch/Logs | AWProcessCommands.log | Contains information for commands sent from AirWatch such as profiles, applications, and product provisioning. |
| /AirWatch/Logs | FusionwlanSetup | Contains information on fusion Wi-Fi profile changes. |
| Root | AW_Setup | Contains information on the AWMasterSetup such as agent install and uninstall processing on a device. |
| /AirWatch/Logs | Awcmclient | Contains information on communications between AWCM client and AirWatch. |
| /AirWatch/Logs | Awapplauncher | Contains information on the application launcher executable. Only present if the App Launcher utility is assigned and utilized by device. |
| /AirWatch/Logs | Awapplyprofile | Contains information on agent settings SML file which is generated during enrollment. |
| /AirWatch/Logs | emScript | Contains information on the native system performance. |
| Program Files/RemoteManagement/Logs | *.log | Contains information on Remote Management communications including that of Registry Editor. |
Workspace ONE Assist - Device side (Agent) logging - Android
Android logging relies on ADB for gathering device side logs. Refer to items headed with Aetherpal in ADB for Android device side logging.
Workspace ONE Assist - Device side (Agent) logging - Windows 10
Agent logs are stored in the following location: C:\ProgramData\Aetherpal\appcache\Data\Logs or C:\ProgramData\Assist\Logs
To update to a verbose agent log:
- Navigate to the install directory which is usually C:\Program Files\AirWatch\Workspace ONE Assist\. Modify the files WorkspaceONE.Assist.Agent.exe.config and WorkspaceONE.Assist.Client.exe.config.
-
- Update the log level section value to "0" from value "3".
- Restart Workspace ONE Assist agent service from services.msc.
- Clear logs and initiate the remote session to gather logs.
- After logs have been gathered revert the logging from verbose back to "3" and restart the Workspace ONE Assist.
Workspace ONE Assist - Device side (Agent) logging - Win Mo/WinCE
Logs are not generated on Windows Mobile and Windows CE by default. To generate logs:
-
In the apListener.application.confg, FileManager.application.config, and RemoteControl.application.config modify the ParamValue from NONE to Debug
-
Original
-
<ModuleParam>
<ParamValue>Log.LogLevel</ParamValue>
<ParamValue>NONE</ParamValue>
</ModuleParam>
-
-
Updated Tag:
-
<ModuleParam>
<ParamValue>Log.LogLevel</ParamValue>
<ParamValue>debug</ParamValue>
</ModuleParam>
-
-
-
Logs are collected at \Program Files\Workspace ONE Assist\
Was this page helpful?