Bluetooth HCI snoop log not generated

Question

I'm running Android 4.4.2 and I enabled the "Bluetooth HCI snoop log" as described here Sniffing/logging your own Android Bluetooth traffic

After turning bluetooth on and off I rebooted the phone. I could not find the log file in the expected location:

$ adb pull /sdcard/btsnoop_hci.log
remote object '/sdcard/btsnoop_hci.log' does not exist

How can I get to the btsnoop_hci.log?

The answer marked as correct is not actually the correct answer. Please scroll to the highest voted answer for the ACTUAL correct answer. — PaulR, Sep 08 '17 at 13:06
Try this for android O, samsung latest: `adb pull /data/log/bt/btsnoop_hci.log` — Divyanshu Kushwaha, Mar 27 '18 at 11:14

score 135 · Answer 1 · edited Dec 04 '21 at 12:28

135

UPDATE: The btsnoop hci log seems to be getting phased out of the user-accessible areas on a lot of phones. Assuming you have hci logging enabled, you can get a bugreport

adb bugreport anewbugreportfolder

Then decompress the folder. If you're lucky there is an 'FS' folder that contains the btsnoop_hci.log log several layers down (not sure why some phones have this and some don't.) If you don`t have it, grab the bug report text file that looks like this

bugreport-2018-08-01-15-08-01.txt

Run btsnooz.py against it. Per Google`s instructions,

To extract snoop logs from the bug report, use the btsnooz script.

Get btsnooz.py.
Extract the text version of the bug report.
Run btsnooz.py on the text version of the bug report:

btsnooz.py BUG_REPORT.txt > BTSNOOP.log

As of 1/12/21 the link to btsnooz is here: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/refs/heads/master/system/tools/scripts/btsnooz.py

LEGACY ANSWER:

You can see where your phone is storing the hci log by reading the bt_stack.conf file. Try

adb shell cat /etc/bluetooth/bt_stack.conf

You will see a line that looks like

# BtSnoop log output file
BtSnoopFileName =/sdcard/btsnoop_hci.log <--your file location

It is usually, but not always (depends on the phone) on the root of the sdcard. There is also a line in this configuration file which may reflect if hci logging is actually on or not

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=false

Toggling the 'Enable Bluetooth HCI snoop log' option in the developer options should change it to

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=true

I say "should" because for some phones this doesn't update this file. You should:

Read the bt_stack.conf file. See where the HCI log should be and if bt snoop logging is actually enabled or not
If developer options say btsnoop_hci logging is on but the bt_stack.conf file says it is off, try power cycling bluetooth and/or your phone.
If your phone is rooted, manually set BtSnoopLogOutput=true

If none of the 3 options work, you're out of luck. BT Snoop hci logging is a bit inconsistent across different phones. I've seen a few phones where I just couldn't get it to work not matter what but for the most cases you should be able to get it going. A rooted phone is not a requirement.

edited Dec 04 '21 at 12:28

Jesse Xu

3
3

answered May 20 '15 at 14:22

TwinPrimesAreEz

1,699
1
12
16

How can i set set BtSnoopLogOutput=true on a rooted phone? – PeppeDAlterio Aug 21 '15 at 08:12
Easiest way would be pull the bt_stack.conf file and then just change 'False' to 'True' in a text editor, then push it back to the correct directory. Note you will probably need to change directory permissions on the phone filesystem to push it back on, which shouldn`t be a problem if you are rooted. – TwinPrimesAreEz Aug 21 '15 at 15:59
Mine says **BtSnoopLogOutput=false**. How to make it **true**? – IgorGanapolsky Mar 13 '17 at 15:48
2

Google Pixel seems to be stuck on `BtSnoopLogOutput=false` – Senseful Jul 04 '17 at 08:28
1

Some other places you may find the `bt_stack.conf` file are `/system/etc/` and `/vendor/etc/` – DearVolt Jul 11 '17 at 20:13
6

I found mine in the bugreport zip at: `FS\data\misc\bluetooth\logs` – Blightbuster Feb 12 '19 at 23:29
Full fail: my lineageos 16.0 on a s7 hasn't any of the `Bt*` values set and changing the config results in `adb: error: failed to copy 'bt_stack.conf' to '/etc/bluetooth/bt_stack.conf': remote couldn't create file: Read-only file system ` – Daniel Alder Oct 26 '19 at 12:28
@Blightbuster same as you on LineageOS it's on `/data/misc/bluetooth/logs/btsnoop_hci.log` – Smeterlink May 11 '20 at 19:06
1

If you go the `btsnooz.py` route, note that it's a python2 script. It took me a while to notice. The error related to running with python3 is: "TypeError: write() argument must be str, not bytes" – rrmoelker Jun 25 '20 at 15:35
I followed these instructions but Wireshark was unable to analyze the log file created. Has the btsnoop format been changed? (S7 Edge, Android 8.0.0) – Jason Steele Dec 12 '20 at 17:36
@JasonSteele I was able to use the current (top) instructions and read the log with Wireshark in October. Pixel 2, Android 11. It seems like an unlikely area to make a change since the format is standardized (RFC 1761) and it's not really user facing. Have you verified that there actually was output in the file? – user3067860 Dec 13 '20 at 19:43
@user3067860 yes, a file was generated. I have a link to it here: https://drive.google.com/file/d/1Y3544DrhPbI9YxktL6rSWkpAe-YeoPn4/view?usp=sharing. I agree that it does sound odd but then I also read somewhere about BlueZ changing (or adding) to the format. – Jason Steele Dec 14 '20 at 16:03
Thanks, "updated answer" was the only solution worked for me on Android 11 OnePlus 6 device. – Aiono Sep 01 '23 at 20:00

PaulFreund · Answer 2 · 2017-10-10T20:20:11.113

17

On Nexus 5X and Pixel C Android O you have to enable bluetooth, enable HCI snooping in developer settings, disable and reenable bluetooth and reboot.

After that you can get the log by going to developer settings and "take bug report" and get a full log.

The file bt_stack.conf is not changed and there is no new file on /sdcard as on other devices

edited Oct 10 '17 at 20:20

answered Oct 10 '17 at 19:28

PaulFreund

441
6
5

I can confirm that this is the only method that works for me. I'm using the Pixel 2 XL on Android 8.1 Oreo. The "take bug report" feature generates an archive and the log file will be in that archive under _FS/data/misc/bluetooth/logs/btsnoop_hci.log_ – jbb Feb 27 '18 at 17:41
This is really the most consistent of the methods that works without any rooting, USB connection, etc. and on the most phones. – GroovyDotCom Jun 21 '18 at 17:40
This worked for my Samsung Galaxy S7. The bug report contains a file FS/data/log/bt/btsnoop_hci.log that can be opened with WireShark. – ZeroOne Nov 11 '18 at 21:38
Are you sure you need to reboot? It works for me without doing that. – Gumby The Green May 20 '20 at 12:26

score 11 · Answer 3 · edited Mar 30 '18 at 18:58

11

For a user version Pixel/Nexus, you may not have the permission to pull out /data/misc/bluetooth/logs/btsnoop_hci.log. You can get the hci log like this:

adb shell dumpsys bluetooth_manager
adb bugreport > BUG_REPORT.txt

You will get a BUG_REPORT.txt and zip file. HCI log will be found under FS\data\misc\bluetooth\logs of the zip file.

edited Mar 30 '18 at 18:58

rene

41,474
78
114
152

answered Feb 28 '18 at 07:03

Fukai

361
1
3
9

1

adb shell dumpsys bluetooth_manager ; adb bugreport > BUG_REPORT.txt – Fukai Feb 28 '18 at 07:11
This just made the `btsnoop_hci.log` appear on my Mi 9. – Avamander Sep 20 '20 at 19:31
works also for moto g6 with Android 9, thanks a lot – Cor Feb 17 '22 at 11:17

rszalski · Answer 4 · 2019-09-17T18:59:11.543

9

On a OnePlus 6 (A6003, Android 9) phone (and I believe other OnePlus phones) the location is:

/sdcard/oem_log/btsnoop

This location does not require rooting nor accessing through adb. The log will have a .cfa extension and is in a binary pcap format suitable for analysis with e.g. Wireshark.

edited Sep 17 '19 at 18:59

answered Mar 09 '19 at 17:08

rszalski

2,205
2
21
23

Yes, but it is still not readable. Did you do something with this logs? it isn't utf-8 and i can't decode that with any coding format. i have only ```IQOS 2.4 ?????[][]????``` etc. How to read that?! One plus 7 pro – Kamil Sep 15 '19 at 11:43
1

@Kamil This is a binary format (`pcap`) which you can analyse with e.g. Wireshark (https://www.wireshark.org/) by simply opening the file. I added this to my answer. – rszalski Sep 17 '19 at 18:58
Okay i got it. I just was sure that its plaintext logs. Thank you very much. – Kamil Sep 18 '19 at 09:12
OMG dude, thanks so much! I'm exactly with an OP6 and the file is right there as you said. Why is the location not standard? – Csaba Toth Sep 02 '20 at 07:23
It is not there on my OnePlus 6P Android 11 – andresp Apr 18 '23 at 19:14

Tontici Oleg · Answer 5 · 2019-01-27T09:11:15.930

6

This is what solved it for me:

1)adb shell cat /etc/bluetooth/bt_stack.conf

to see what is the log file name, for me it is :

/data/log/bt/btsnoop_hci.log

The tricky part is that files get generated with timestamp in their names so you won't be able to get them(it) just by using

adb pull /data/log/bt/btsnoop_hci.log

2)Use adb pull /data/log/bt/ instead, and you will get the whole folder, with all logs

edited Jan 27 '19 at 09:11

answered Jan 27 '19 at 08:40

Tontici Oleg

91
1
5

score 4 · Answer 6 · answered Dec 02 '15 at 02:41

4

On mine, bt_stack.conf showed /sdcard/Android/data/btsnoop_hci.log

answered Dec 02 '15 at 02:41

abourget

2,351
19
17

3

Every device could be different. Location of this log file is specified in **/etc/bluetooth/bt_stack.conf** – IgorGanapolsky Mar 13 '17 at 15:47

score 3 · Answer 7 · edited Sep 19 '22 at 11:53

3

For Samsung s8, the magic location is /data/log/bt/
and you can get it if you take a bugreport

edited Sep 19 '22 at 11:53

Community

1
1

answered Jun 02 '18 at 22:08

GroovyDotCom

1,304
2
15
29

Thanks for the upvote but see also PaulFreund's answer for non-rooting solution. – GroovyDotCom Sep 05 '18 at 06:52

score 1 · Answer 8 · edited Jun 13 '22 at 17:24

1

On a Xiaomi POCO X3 (MIUI) (may be only Poco X3)

Enable developer mode and HCI log.

Call * # * # 284 # * # *
Apply
Explore the folder at /MIUI/debug_log/
Copy bugreport-******.zip to PC
Unzip the archive to a new folder
Find at the new folder another ZIP archive and unzip it
Find log and Wireshark format files (cfa) in FS\data\misc\bluetooth\logs

edited Jun 13 '22 at 17:24

nvidot

1,262
1
7
20

answered Jun 09 '22 at 08:34

Алексей Таянов

11
2

score 0 · Answer 9 · answered Feb 03 '18 at 16:01

@TwinPrimesAreEz is excellent but there is a fourth option; at least when your device is rooted. Call:

/system/bin/btsnoop

Somewhere this tool was removed but it still exists on my device. Whatismore, it seems to be called when bluetooth is enabled. In logcat I see: "btsnoop_dump: : snoop_log_open: Unable to open the Dir entry". Not sure why it is unable to open that dir (btw, it is /data/media/0) But I suspect that this tool somehow interferes with the new HCI snooping option integrated into Android. But if you call that tool directly (e.g. via adb shell or Terminal emulator) it works. For me it created file /data/media/0/hci_snoop20180203164422.cfa.

@Mans: Yes, you can open it using Wireshark. – Jack Miller Oct 26 '18 at 05:49 — Jack Miller, Oct 26 '18 at 05:49

score 0 · Answer 10 · answered Jul 03 '20 at 16:55

All the above were helpful -- on an S8 and Windows 10, the option from Fukai/Rene about using the bug report was the best for me. (Slightly different file path, but the zip file did have the log in it.)

However, I later noticed that I got a NOTIFICATION in Android to "SHARE YOUR BUG REPORT", and when I selected the notification I had options to email/save to G Drive/etc. Emailed the txt and zip to myself, and that was that, skipping adb and the other rigmarole.

score 0 · Answer 11 · answered Apr 16 '22 at 20:16

0

On redmi note 7 I found log directly on phon in location:

/storage/emulated/0/MIUI/debug_log/common/btsnoop_hci_20220416214313.cfa

using search, I have written "bt" and found theae files!

answered Apr 16 '22 at 20:16

Ivan Kunović Robokacija

11
1

Bluetooth HCI snoop log not generated

11 Answers11

Linked