In addition to core and integrated services, VMware provides logs to assist in troubleshooting your devices running Workspace ONE UEM. Learn more about the types of deivces supported, how to change log levels, and what log information is provided by VMware Workspace ONE UEM for your devices.

Explore and implement logging for end-user devices running the Workspace ONE Intelligent Hub. Some logging may require additional components or requirements to gather.

iOS Devices

Learn more about the Workspace ONE UEM logging functions available for iOS Devices.

Method Log Name Description
Console app on macOS *.txt Contains information related to all device side transactions including MDM, Enrollment, access, and application run history.
Hub App w/ Debug enabled in SDK Agentlog####.txt Contains information on system messages and stack traces when devices throw errors that are written from applications with the Log class.
Crash Logs *.crash Contains information on application crashes that is stored on iOS devices
sysdiagnose *.tar.gz Instructions available on Apple developer website. These logs will contain information from the past. If your issue has been reproduced in the last few hours, these logs should reference it.

macOS Devices

Learn more about the Workspace ONE UEM logging functions available for macOS Devices.

Method Log Name Description
Console.app *.txt Contains information related to all device side transactions including MDM, enrollment, access, and application run history.
/Library/Logs/DiagnosticReports Intelligent Hub*.crash & hubd*.crash Contains information on crashes related to the Hub daemon.
Sudo Log collect (/var/log/) System.log Contains information on the mdmd and other OS-specific activities. Used only for macOS 10.12+
/var/log/ Install.log Contains information on package installations including Munki
/Library/Application Support/AirWatch/Data/Munki/managed installs/logs/ ManagedSoftwareUpdate.log Main Munki logging file which will contain information pertaining to macOS software deployment through UEM Internal Apps.
/Library/Application Support/Airwatch/Data/Munki/munki_repo/munkiData/ Munki_data.plist Contains internal metadata information on current software being deployed through UEM Internal Apps.
/Library/Preferences/ AirWatchManagedInstalls.plist Preference file used for VMware integration with Munki.
/Library/Application Support/AirWatch/Data/Munki/Managed Installs/ InstallInfo.plist Contains status information on current software being deployed through UEM Internal Apps.
/Library/Application Support/AirWatch/Data/Munki/Managed Installs/ ManagedInstallReport.plist Contains detailed status information on current software being deployed through UEM Internal Apps.
/Library/Application Support/AirWatch/Data AppStatuses_WS1.plist Used for displaying software download and installation statuses within Intelligent Hub.
/Library/Application Support/AirWatch/Data/Munki/Munki_Repo/catalogs/device_catalog.plist device_catalog.plist Contains metadata information about the internal apps like bundle id, installation criteria, pre/post-install scripts etc.
/Library/Application Support/AirWatch/Data/Munki/Munki_Repo/manifests/device_manifest.plist device_manifest.plist Contains all the assigned apps.
/Library/Application Support/AirWatch/Data/VPPApps.plist VPPApps.plist Contains information about assigned VPP apps like appurl, name, bundleid, status etc.
/Library/Application Support/AirWatch/Data/CustomAttributes/CustomAttributes.plist CustomAttributes.plist Contains the latest key-value pairs generated by Custom Attribute scripts. Contents in this plist will be sent to UEM in regular Hub samples.
/Library/Application Support/AirWatch/Data/com.vmware.hub.flags.plist com.vmware.hub.flags.plist Status of recently released features in the form of key-value pair. Key is the name of the feature and value can be either True/False.
/Library/Application Support/AirWatch/Data/ProductsNew ProductsNew Contains information about File/Action Products deployed through UEM Product Provisioning.

For more information on how to collect logs, see Request Device Log in Introduction to Workspace ONE UEM powered by AirWatch for macOS.

Android Devices

Learn more about the Workspace ONE UEM logging functions available for Android Devices.

Method

Log Name

Description

ADB/Android Studio/RXLogger

*.txt

Contains information on app level traffic such as system messages and stack traces.

Hub Debug Logs

*.txt

Contains information on app level traffic such as system messages and stack traces filtered to the Workspace ONE Intelligent Hub and PackageManager.

DumpState Logs

*.txt

Contains information collected from Android Debug Bridge (ADB) without active connection to device and used for historical logging.

Android Enterprise Wipe Logs

If an Android device in your deployment is enterprise-wiped, additional logs are available.

To capture the latest set of logs, tap the Workspace ONE Intelligent Hub welcome screen header on the affected device 5 times. The device opens any available email app on the device where you can send the additional logging to administrators or support to help with investigation.

This logging function requires a minimum version of Workspace ONE Intelligent Hub for Android v8.1.

Google Bug Reports

To capture a Google bug Report, first navigate to Device Settings > Software Information > Build Number and tap Build Number 7 times to enable developer options. This will make an option available under Developer Options > Take Bug Report. After replication of the issue select this option and allow 1-2 minutes for the report to be generated. When the report generates, there a push notification appears that can be opened to select how to share the report (E-mail, Bluetooth, etc.).

Telecom Service App Reports

To capture a Telecom Service report, open the telecom service app and tap the screen 5 times. A notification appears that file logging is enabled. Open the application menu and select Copy Log/DB. Open the native file manager and navigate to Internal Storage > Android > Data > com.airwatch.sampler > Files > telecom-log-dir > #.txt. Transfer this file off of the device for further review.

Windows Phone Devices

Learn more about the Workspace ONE UEM logging functions available for Windows Phone Devices.

Method

Log Name

Description

Field Medic

*.etl

Contains information on enrollment and most other MDM related functions.

Widows Desktop Devices (Windows HUB)

For deployments using the VMware Windows HUB, you can use Remote Log collection to gather Windows Desktop logs.

  1. In the Workspace ONE UEM Device List view, select the device you want to collect logs for.
  2. Select More ActionsRequest Device Log.
  3. Selectthe log source: Hub or System.
    1. Hub - logs related to the Workspace ONE Intelligent Hub such as the Hub and application deployment logs
    2. System - logs related to the system such as Event Viewer logs and registry export
  4. Navigate to More > Attachments > Documents. Select the log name to download the log bundle and view the logs. The logs are contained in a .ZIP folder.
Method Log Name Description
/Hub/Agents/ApplicationDeploymentAgent/ RegistryExport.txt Contains information on application deployment flows.
/Hub/Agents/ApplicationDeploymentAgent/ AirWatchMDM-*.etl Contains information on application deployment flows.
Hub/Agents/WindowsUnifiedAgent/ AWProcessCommands.log Contains information around installations that utilize the agent such as encryption and product provisioning.
Hub/Agents/WindowsUnifiedAgent/ NativeEnrollment.log Contains information on agent based enrollments.
Hub/Agents/WindowsUnifiedAgent/ PowershellExecute.log Contains information on PowerShell commands run through product provisioning.
Hub/Agents/WindowsUnifiedAgent/ TaskScheduler.log Contains information on Task scheduler’s local enforcement of policies, and samples sent to the console.
Hub/Agents/WindowsUnifiedAgent/ AwclClient.log Contains information on communications between AWCM client and Workspace ONE UEM.
Hub/Agents/WindowsUnifiedAgent/ SSOCommunicationHandler.log Contains information on agent post-enrollment single sign-on.
Hub/Agents/WindowsUnifiedAgent/ Updater.log Contains information on agent auto update procedures.
Hub/Agents/WindowsUnifiedAgent/ AwAirWatchlpc.log Contains communication records between the Workspace ONE app and other services.
Hub/Agents/WindowsUnifiedAgent/ WorkspaceOneProvisioning.log Contains information on Worksapce ONE app installations and downloads.
Hub/Agents/ProvisioningAgent/ awProvAgent.log Contains the provisioning agent event logging.
System/Device/PCRefresh/ RegistryExport.txt Contains registry exports related to Software and user provisioning

System/Device/PCRefresh/ or

C:\Recovery\OEM\VMware\

* Contains logs and application data with the app deployment cache, Hub database with all configurations and settings, and registry settings with MDM device ID.
System/Device/Windows/ Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provided_Admin_EventLogs.evtx Contains information on MDM event logs
System/Device/Windows/ System_EventLogs.evtx Contains information on system Event Logs
System/Device/Windows RegistryExport.txt Contains a list of successfully applies CSPs on the device (profiles and apps)
System/Device/Windows/Environment/ Processes.txt Contains a list of currently running processes
System/Device/Windows/Environment/ Services.txt Contains a list of currently registered services

Windows Desktop Devices (Without Windows HUB)

If your deployment does not include the VMware Windows HUB, use the following Windows Desktop logging options.

Method Log Name Description
Windows Event Viewer *.evtx Contains information on nrolment using Work Access and MDM functions that do not require the Unified Agent (Samples, Profiles, Commands).
/AirWatch/UnifiedAgent/Logs/ AwprocessCommands.Log Contains information on installs that utilize the Unified Agent such as encryption and product provisioning.
/AirWatch/UnifiedAgent/Logs/ AWLPC.Log Contains information related to the communications between the Unified Agent and AirWatch
/AirWatch/UnifiedAgent/Logs/ NativeEnrollment.log Contains information around the Workspace ONE Intelligent Hub-Based nrolment method.
/AirWatch/UnifiedAgent/Logs/ PowershellExecute.log Contains information on PowerShell commands that are run via product provisioning.
/AirWatch/UnifiedAgent/Logs/ AwclClient.log Contains information on communications between AWCM client and AirWatch.
/AirWatch/UnifiedAgent/Logs/ TaskScheduler.log Contains information on the Task Scheduler’s local enforcement of policies.
/AirWatch/UnifiedAgent/Logs/ SSOCommunicationHandler.log Contains information on post nrolment SSO for Workspace ONE Intelligent Hub.
/AirWatch/UnifiedAgent/Logs/ RMService.log Contains information around the Workspace ONE Intelligent Hub-Based enrolment method.

Windows Rugged Devices

Learn more about the Workspace ONE UEM logging functions available forWindows Rugged Devices.

Method

Log Name

Description

/AirWatch/Logs

Awregisterdevice

Contains information on device registration that occurs during the enrollment process.

/AirWatch/Logs

AWService.log

Contains information on communications between the device and AirWatch including managed beacon and interrogator samples.

/AirWatch/Logs

AWApplicationManager.log

Contains information related to product provisioning.

/AirWatch/Logs

AWProcessCommands.log

Contains information for commands sent from AirWatch such as profiles, applications, and product provisioning.

/AirWatch/Logs

FusionwlanSetup

Contains information on fusion Wi-Fi profile changes.

Root

AW_Setup

Contains information on the AWMasterSetup such as agent install and uninstall processing on a device.

/AirWatch/Logs

Awcmclient

Contains information on communications between AWCM client and AirWatch.

/AirWatch/Logs

Awapplauncher

Contains information on the application launcher executable. Only present if the App Launcher utility is assigned and utilized by device.

/AirWatch/Logs

Awapplyprofile

Contains information on agent settings SML file which is generated during enrollment.

/AirWatch/Logs

emScript

Contains information on the native system performance.

Program Files/RemoteManagement/Logs *.log Contains information on Remote Management communications including that of Registry Editor.