androidbluetoothandroid-4.4-kitkatandroid-bluetooths5

Reputation: 2091

Bluetooth HCI snoop log not generated

I'm running Android 4.4.2 and I enabled the "Bluetooth HCI snoop log" as described here Sniffing/logging your own Android Bluetooth traffic

After turning bluetooth on and off I rebooted the phone. I could not find the log file in the expected location:

$ adb pull /sdcard/btsnoop_hci.log
remote object '/sdcard/btsnoop_hci.log' does not exist

How can I get to the btsnoop_hci.log?

Upvotes: 44

Answers (12)

Mark Tester

Reputation: 1

On my old Samsung A5 (SM-A520F) it worked when turning on the HCI snooping in the developer settings and then rebooting. Then finally, the log files were contained in the bugreport generated via adb bugreport.

Upvotes: 0

GroovyDotCom

Reputation: 1374

For Samsung s8, the magic location is /data/log/bt/
and you can get it if you take a bugreport

Upvotes: 3

Алексей Таянов

Reputation: 11

On a Xiaomi POCO X3 (MIUI) (may be only Poco X3)

Enable developer mode and HCI log.

Call * # * # 284 # * # *
Apply
Explore the folder at /MIUI/debug_log/
Copy bugreport-******.zip to PC
Unzip the archive to a new folder
Find at the new folder another ZIP archive and unzip it
Find log and Wireshark format files (cfa) in FS\data\misc\bluetooth\logs

Upvotes: 1

Ivan Kunović Robokacija

Reputation: 36

On redmi note 7 I found log directly on phon in location:

/storage/emulated/0/MIUI/debug_log/common/btsnoop_hci_20220416214313.cfa

using search, I have written "bt" and found theae files!

Upvotes: 0

TwinPrimesAreEz

Reputation: 1779

UPDATE: The btsnoop hci log seems to be getting phased out of the user-accessible areas on a lot of phones. Assuming you have hci logging enabled, you can get a bugreport

adb bugreport anewbugreportfolder

Then decompress the folder. If you're lucky there is an 'FS' folder that contains the btsnoop_hci.log log several layers down (not sure why some phones have this and some don't.) If you don`t have it, grab the bug report text file that looks like this

bugreport-2018-08-01-15-08-01.txt

Run btsnooz.py against it. Per Google`s instructions,

To extract snoop logs from the bug report, use the btsnooz script.

Get btsnooz.py.
Extract the text version of the bug report.
Run btsnooz.py on the text version of the bug report:

btsnooz.py BUG_REPORT.txt > BTSNOOP.log

As of 1/12/21 the link to btsnooz is here: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/refs/heads/master/system/tools/scripts/btsnooz.py

LEGACY ANSWER:

You can see where your phone is storing the hci log by reading the bt_stack.conf file. Try

adb shell cat /etc/bluetooth/bt_stack.conf

You will see a line that looks like

# BtSnoop log output file
BtSnoopFileName =/sdcard/btsnoop_hci.log <--your file location

It is usually, but not always (depends on the phone) on the root of the sdcard. There is also a line in this configuration file which may reflect if hci logging is actually on or not

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=false

Toggling the 'Enable Bluetooth HCI snoop log' option in the developer options should change it to

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=true

I say "should" because for some phones this doesn't update this file. You should:

Read the bt_stack.conf file. See where the HCI log should be and if bt snoop logging is actually enabled or not
If developer options say btsnoop_hci logging is on but the bt_stack.conf file says it is off, try power cycling bluetooth and/or your phone.
If your phone is rooted, manually set BtSnoopLogOutput=true

If none of the 3 options work, you're out of luck. BT Snoop hci logging is a bit inconsistent across different phones. I've seen a few phones where I just couldn't get it to work not matter what but for the most cases you should be able to get it going. A rooted phone is not a requirement.

Upvotes: 142

ben funke

Reputation: 1

All the above were helpful -- on an S8 and Windows 10, the option from Fukai/Rene about using the bug report was the best for me. (Slightly different file path, but the zip file did have the log in it.)

However, I later noticed that I got a NOTIFICATION in Android to "SHARE YOUR BUG REPORT", and when I selected the notification I had options to email/save to G Drive/etc. Emailed the txt and zip to myself, and that was that, skipping adb and the other rigmarole.

Upvotes: 0

rszalski

Reputation: 2265

On a OnePlus 6 (A6003, Android 9) phone (and I believe other OnePlus phones) the location is:

/sdcard/oem_log/btsnoop

This location does not require rooting nor accessing through adb. The log will have a .cfa extension and is in a binary pcap format suitable for analysis with e.g. Wireshark.

Upvotes: 8

Tontici Oleg

Reputation: 101

This is what solved it for me:

1)adb shell cat /etc/bluetooth/bt_stack.conf

to see what is the log file name, for me it is :

/data/log/bt/btsnoop_hci.log

The tricky part is that files get generated with timestamp in their names so you won't be able to get them(it) just by using

adb pull /data/log/bt/btsnoop_hci.log

2)Use adb pull /data/log/bt/ instead, and you will get the whole folder, with all logs

Upvotes: 7

Fukai

Reputation: 461

For a user version Pixel/Nexus, you may not have the permission to pull out /data/misc/bluetooth/logs/btsnoop_hci.log. You can get the hci log like this:

adb shell dumpsys bluetooth_manager
adb bugreport > BUG_REPORT.txt

You will get a BUG_REPORT.txt and zip file. HCI log will be found under FS\data\misc\bluetooth\logs of the zip file.

Upvotes: 11

Jack Miller

Reputation: 7707

@TwinPrimesAreEz is excellent but there is a fourth option; at least when your device is rooted. Call:

/system/bin/btsnoop

Somewhere this tool was removed but it still exists on my device. Whatismore, it seems to be called when bluetooth is enabled. In logcat I see: "btsnoop_dump: : snoop_log_open: Unable to open the Dir entry". Not sure why it is unable to open that dir (btw, it is /data/media/0) But I suspect that this tool somehow interferes with the new HCI snooping option integrated into Android. But if you call that tool directly (e.g. via adb shell or Terminal emulator) it works. For me it created file /data/media/0/hci_snoop20180203164422.cfa.

Upvotes: 0