In addition to core and integrated services, VMware provides logs to troubleshoot your devices running Workspace ONE UEM. Learn more about the types of devices supported, how to change log levels, and what log information is provided by VMware Workspace ONE UEM for your devices.

Explore and implement logging for end-user devices running the Workspace ONE Intelligent Hub. Some logging might require additional components or requirements gathering.

iOS Devices

Learn more about the Workspace ONE UEM logging functions available for iOS Devices.

Method

Log Name

Description

Console app on macOS

*.txt

Contains information related to all device side transactions including MDM, Enrollment, access, and application run history.

Hub App w/ Debug enabled in SDK

Agentlog####.txt

Contains information on system messages and stack traces when devices throw errors that are written from applications with the Log class.

Crash Logs

*.crash

Contains information on application crashes that is stored on iOS devices.

sysdiagnose

*.tar.gz

Instructions available on Apple developer website. These logs contain information from the past. If your issue was reproduced in the last few hours, then these logs should reference it.

macOS Devices

Learn more about the Workspace ONE UEM logging functions available for macOS Devices.

Method

Log Name

Description

Console.app

*.txt

Contains information related to all device side transactions including MDM, enrollment, access, and application run history.

/Library/Logs/DiagnosticReports

Intelligent Hub*.crash & hubd*.crash

Contains information on crashes related to the Hub daemon.

Sudo Log collect (/var/log/)

System.log

Contains information on the mdmd and other OS-specific activities. Used only for macOS 10.12+.

/var/log/

Install.log

Contains information on package installations including Munki.

/Library/Application Support/AirWatch/Data/Munki/managed installs/logs/

ManagedSoftwareUpdate.log

Main Munki logging file which contain information pertaining to macOS software deployment through UEM Internal Apps.

/Library/Application Support/Airwatch/Data/Munki/munki_repo/munkiData/

Munki_data.plist

Contains internal metadata information on current software being deployed through UEM Internal Apps.

/Library/Preferences/

AirWatchManagedInstalls.plist

Preference file used for VMware integration with Munki.

/Library/Application Support/AirWatch/Data/Munki/Managed Installs/

InstallInfo.plist

Contains status information on current software being deployed through UEM Internal Apps.

/Library/Application Support/AirWatch/Data/Munki/Managed Installs/

ManagedInstallReport.plist

Contains detailed status information on current software being deployed through UEM Internal Apps.

/Library/Application Support/AirWatch/Data

AppStatuses_WS1.plist

Used for displaying software download and installation statuses within Intelligent Hub.

/Library/Application Support/AirWatch/Data/Munki/Munki_Repo/catalogs/device_catalog.plist

device_catalog.plist

Contains metadata information about the internal apps like bundle id, installation criteria, pre/post-install scripts, and so on.

/Library/Application Support/AirWatch/Data/Munki/Munki_Repo/manifests/device_manifest.plist

device_manifest.plist

Contains all the assigned apps.

/Library/Application Support/AirWatch/Data/VPPApps.plist

VPPApps.plist

Contains information about assigned VPP apps like appurl, name, bundleid, status, and so on.

/Library/Application Support/AirWatch/Data/CustomAttributes/CustomAttributes.plist

CustomAttributes.plist

Contains the latest key-value pairs generated by Custom Attribute scripts. Contents in this plist will be sent to UEM in regular Hub samples.

/Library/Application Support/AirWatch/Data/com.vmware.hub.flags.plist

com.vmware.hub.flags.plist

Status of recently released features in the form of key-value pair. Key is the name of the feature and value can be either True/False.

/Library/Application Support/AirWatch/Data/ProductsNew

ProductsNew

Contains information about File/Action Products deployed through UEM Product Provisioning.

For more information on how to collect logs, see Request Device Logs in Introduction to Managing macOS Devices.

Android Devices

Learn more about the Workspace ONE UEM logging functions available for Android Devices.

Method

Log Name

Description

ADB/Android Studio/RXLogger

*.txt

Contains information on app level traffic such as system messages and stack traces.

Hub Debug Logs

*.txt

Contains information on app level traffic such as system messages and stack traces filtered to the Workspace ONE Intelligent Hub and PackageManager.

DumpState Logs - Samsung Only

*.txt

Contains information on app level traffic such as system messages and stack traces (logcat) collected without active ADB connection to device and used for historical logging.

Bug Report

*.zip

Contains information about the current device state and captures app level traffic such as system messages and stack traces (logcat). In contrast with ADB, Dumpstate captures only the current logcat buffer.

Network Logging

*.txt

Captures DNS requests and network connections from apps to a log file for the specified duration. Note: Available on Work Managed devices running Android 8 or later.

Security Logging

*.txt

Captures possible security breaches such as pre and post boot activities, authentication attempts, credential storage modification, attempted adb connections, and more. Note: Requires Work Managed Android 7.0 or later devices and Workspace ONE Intelligent Hub 21.05 for Android.

Android Enterprise Wipe Logs - Android (Legacy)

More logs are available if an Android device in your deployment is enterprise-wiped.

To capture the latest set of logs, tap the Workspace ONE Intelligent Hub welcome screen header on the affected device five times. Selecting share opens any available email app on the device where you can send the additional logging to administrators or support to help with the investigation. You can also select Copy, which saves a copy of the file on the device's file storage, which can then be easily extracted from the device.

This logging function requires a minimum version of Workspace ONE Intelligent Hub for Android v8.1.

Google Bug Reports

To capture a Google bug report, navigate to Device Settings > Software Information > Build Number and tap Build Number seven times to enable developer options. An option is available under Developer Options > Take Bug Report. After replication of the issue, select this option and allow 1-2 minutes for the report to be generated. When the report generates, a push notification appears that can be opened. From the notification, select how to share the report (E-mail, Bluetooth, etc.).

For Work Managed devices, Google bug reports can also be gathered through the Workspace ONE UEM console. Under the device details page navigate to and select More Actions > Request Device Log > Snapshot System. A Google bug report will be generated. The report can be accessed from Device Details > More > Attachments > Documents.

Performance Logging

Explore and implement additional logs to troubleshoot and improve your Workspace ONE UEM deployment.

Some logging might require additional components or gathering requirements.

Table 1. Third-Party SDK App Logs

Method/Folder

Log Name

Description

ADB/Android Studio/RXLogger

*.txt

Contains real time logs for SDK application logging from developer run application.

Console app on macOS

*.txt

Contains real time logs for SDK application logging from developer run application.

Console (Apps&Book\Analytics\App Logs)

AppLog####.txt

Contains information from third-party SDK application integrations.

Telecom Service App Reports

To capture a Telecom Service report, open the Telecom service app and tap the screen five times. A notification appears that file logging is enabled. Open the application menu and select Copy Log/DB. Open the native file manager and navigate to Internal Storage > Android > Data > com.airwatch.sampler > Files > telecom-log-dir > #.txt. Transfer this file off of the device for further review.

Windows Phone Devices - Legacy

Learn more about the Workspace ONE UEM logging functions available for Windows Phone Devices.

Method

Log Name

Description

Field Medic

*.etl

Contains information on enrollment and most other MDM related functions.

Windows Desktop Devices (Windows HUB)

For deployments using the VMware Windows HUB, use Remote Log collection to gather Windows Desktop logs.

  1. In the Workspace ONE UEM Device List view, select the device you want to collect logs for.

  2. Select More ActionsRequest Device Log.

  3. Select the log source: Hub or System.

    1. Hub - logs related to the Workspace ONE Intelligent Hub such as the Hub and application deployment logs

    2. System - logs related to the system such as Event Viewer logs and registry export.

  4. Navigate to More > Attachments > Documents. Select the log name to download the log bundle and view the logs. The logs are contained in a .ZIP folder.

Method

Log Name

Description

/Hub/Agents/ApplicationDeploymentAgent/

RegistryExport.txt

Contains information on application deployment flows.

/Hub/Agents/ApplicationDeploymentAgent/

AirWatchMDM-*.etl

Contains information on application deployment flows.

Hub/Agents/WindowsUnifiedAgent/

AWProcessCommands.log

Contains information around installations that use the agent such as encryption and product provisioning.

Hub/Agents/WindowsUnifiedAgent/

NativeEnrollment.log

Contains information on agent based enrollments.

Hub/Agents/WindowsUnifiedAgent/

PowershellExecute.log

Contains information on PowerShell commands run through product provisioning.

Hub/Agents/WindowsUnifiedAgent/

TaskScheduler.log

Contains information on Task scheduler’s local enforcement of policies, and samples sent to the console.

Hub/Agents/WindowsUnifiedAgent/

AwclClient.log

Contains information on communications between AWCM client and Workspace ONE UEM.

Hub/Agents/WindowsUnifiedAgent/

SSOCommunicationHandler.log

Contains information on agent post-enrollment single sign-on.

Hub/Agents/WindowsUnifiedAgent/

Updater.log

Contains information on agent auto update procedures.

Hub/Agents/WindowsUnifiedAgent/

AwAirWatchlpc.log

Contains communication records between the Workspace ONE app and other services.

Hub/Agents/WindowsUnifiedAgent/

WorkspaceOneProvisioning.log

Contains information on Workspace ONE app installations and downloads.

Hub/Agents/ProvisioningAgent/

awProvAgent.log

Contains the provisioning agent event logging.

System/Device/PCRefresh/

RegistryExport.txt

Contains registry exports related to software and user provisioning.

System/Device/PCRefresh/ or

C:\Recovery\OEM\VMware\

*

Contains logs and application data with the app deployment cache, Hub database with all configurations and settings, and registry settings with MDM device ID.

System/Device/Windows/

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provided_Admin_EventLogs.evtx

Contains information on MDM event logs.

System/Device/Windows/

System_EventLogs.evtx

Contains information on system Event Logs.

System/Device/Windows

RegistryExport.txt

Contains a list of successfully applies CSPs on the device (profiles and apps).

System/Device/Windows/Environment/

Processes.txt

Contains a list of currently running processes.

System/Device/Windows/Environment/

Services.txt

Contains a list of currently registered services.

Windows Desktop Devices (Without Windows HUB)

If your deployment does not include the VMware Windows HUB, use the following Windows Desktop logging options.

Method

Log Name

Description

Windows Event Viewer

*.evtx

Contains information on nrolment using Work Access and MDM functions that do not require the Unified Agent (Samples, Profiles, Commands).

/AirWatch/UnifiedAgent/Logs/

AwprocessCommands.Log

Contains information on installs that use the Unified Agent such as encryption and product provisioning.

/AirWatch/UnifiedAgent/Logs/

AWLPC.Log

Contains information related to the communications between the Unified Agent and AirWatch.

/AirWatch/UnifiedAgent/Logs/

NativeEnrollment.log

Contains information around the Workspace ONE Intelligent Hub-Based nrolment method.

/AirWatch/UnifiedAgent/Logs/

PowershellExecute.log

Contains information on PowerShell commands that are run via product provisioning.

/AirWatch/UnifiedAgent/Logs/

AwclClient.log

Contains information on communications between AWCM client and AirWatch.

/AirWatch/UnifiedAgent/Logs/

TaskScheduler.log

Contains information on the Task Scheduler’s local enforcement of policies.

/AirWatch/UnifiedAgent/Logs/

SSOCommunicationHandler.log

Contains information on post nrolment SSO for Workspace ONE Intelligent Hub.

/AirWatch/UnifiedAgent/Logs/

RMService.log

Contains information around the Workspace ONE Intelligent Hub-Based enrollment method.

Windows Rugged Devices

Learn more about the Workspace ONE UEM logging functions available forWindows Rugged Devices.

Method

Log Name

Description

/AirWatch/Logs

Awregisterdevice

Contains information on device registration that occurs during the enrollment process.

/AirWatch/Logs

AWService.log

Contains information on communications between the device and AirWatch including managed beacon and interrogator samples.

/AirWatch/Logs

AWApplicationManager.log

Contains information related to product provisioning.

/AirWatch/Logs

AWProcessCommands.log

Contains information for commands sent from AirWatch such as profiles, applications, and product provisioning.

/AirWatch/Logs

FusionwlanSetup

Contains information on fusion Wi-Fi profile changes.

Root

AW_Setup

Contains information on the AWMasterSetup such as agent install and uninstall processing on a device.

/AirWatch/Logs

Awcmclient

Contains information on communications between AWCM client and AirWatch.

/AirWatch/Logs

Awapplauncher

Contains information on the application launcher executable. Only present if the App Launcher utility is assigned and utilized by device.

/AirWatch/Logs

Awapplyprofile

Contains information on agent settings SML file which is generated during enrollment.

/AirWatch/Logs

emScript

Contains information on the native system performance.

Program Files/RemoteManagement/Logs

*.log

Contains information on Remote Management communications including that of Registry Editor.

Workspace ONE Assist - Device side (Agent) logging - Android

Android logging relies on ADB for gathering device side logs. Refer to items headed with Aetherpal in ADB for Android device side logging.

Workspace ONE Assist - Device side (Agent) logging - Windows 10

Agent logs are stored in the following location: C:\ProgramData\Aetherpal\appcache\Data\Logs or C:\ProgramData\Assist\Logs

To update to a verbose agent log:

  1. Navigate to the install directory which is usually C:\Program Files\VMware\Workspace ONE Assist\.

  2. Modify the files WorkspaceONE.Assist.Agent.exe.config and WorkspaceONE.Assist.Client.exe.config.

    1. Update the log level section value to "0" from value "3".

  3. Restart Workspace ONE Assist agent service from services.msc.

  4. Clear logs and initiate the remote session to gather logs.

  5. After logs have been gathered revert the logging from verbose back to "3" and restart the Workspace ONE Assist.

Workspace ONE Assist - Device side (Agent) logging - Win Mo/WinCE

Logs are not generated on Windows Mobile and Windows CE by default. To generate logs:

  1. In the apListener.application.confg, FileManager.application.config, and RemoteControl.application.config modify the ParamValue from NONE to Debug

    1. Original

      1. <ModuleParam>

        <ParamValue>Log.LogLevel</ParamValue>

        <ParamValue>NONE</ParamValue>

        </ModuleParam>

    2. Updated Tag:

      1. <ModuleParam>

        <ParamValue>Log.LogLevel</ParamValue>

        <ParamValue>debug</ParamValue>

        </ModuleParam>

  2. Logs are collected at \Program Files\Workspace ONE Assist\