Starting with Android 5, the in-kernel logger driver is deprecated which exposed the ring buffers through /dev/log/*
character devices. Instead a userspace logging daemon named logd manages buffers “main”, “system”, “radio”, “events”, and “crash”. Optional buffers “security” (e.g. for adb shell
/push
/pull
logging) and on userdebug
builds “kernel” (for klogd
) and “stats” (for logs statistics) were added later. logd
mainly covers the functionality of its desktop counterpart syslogd, but also includes klogd and partially auditd to get logs from SELinux subsystem of kernel. Behavior of logging daemon is controlled through different properties.
Apps and native processes write their logs to relevant buffers through socket /dev/socket/logdw
(by making use of liblog functions). logcat
command reads the buffers from /dev/socket/logdr
while controls the daemon and buffers through /dev/socket/logd
socket. Use -g
/-G
options to get and set size of individual buffers:
-g, --buffer-size
Get the size of the ring buffer.
-G <size>, --buffer-size=<size>
Set size of log ring buffer, may suffix with K or M.
There's also an option in Developer Options: Logger buffer sizes (which also sets property persist.logd.size
) to set same size for all buffers.
persist.logd.size
is read from /data/property/
which isn't available unless /data
is mounted and decrypted (in case of FDE). But sometimes buffers may overflow even before that, so the solution is to set ro.logd.size
(through default.prop
/build.prop
or directly in some *.rc
file) before the logd
service is started.
adb logcat > my_log_file.log
running isn't an option?