Bluetooth HCI snoop log not generated

Question

I'm running Android 4.4.2 and I enabled the "Bluetooth HCI snoop log" as described here Sniffing/logging your own Android Bluetooth traffic

After turning bluetooth on and off I rebooted the phone. I could not find the log file in the expected location:

$ adb pull /sdcard/btsnoop_hci.log
remote object '/sdcard/btsnoop_hci.log' does not exist

How can I get to the btsnoop_hci.log?

Solution 1

NOTE: This answer is not the correct answer. Please scroll to the highest voted answer for the correct answer.

According to my experience the Bluetooth HCI snooping feature requires your device to be rooted. On my rooted Samsung Galaxy S GT-I9000 it works fine while on my non-rooted Galaxy S3 Neo this feature does not work.

Moreover, you should make sure that you have not accidently deleted the file. Whenever I delete the file I have to re-enable the Bluetooth snooping feature in order to make the system recreate the log file.

Solution 2

UPDATE: The btsnoop hci log seems to be getting phased out of the user-accessible areas on a lot of phones. Assuming you have hci logging enabled, you can get a bugreport

adb bugreport anewbugreportfolder

Then decompress the folder. If you're lucky there is an 'FS' folder that contains the btsnoop_hci.log log several layers down (not sure why some phones have this and some don't.) If you don`t have it, grab the bug report text file that looks like this

bugreport-2018-08-01-15-08-01.txt

Run btsnooz.py against it. Per Google`s instructions,

To extract snoop logs from the bug report, use the btsnooz script.

Get btsnooz.py.
Extract the text version of the bug report.
Run btsnooz.py on the text version of the bug report:

btsnooz.py BUG_REPORT.txt > BTSNOOP.log

As of 1/12/21 the link to btsnooz is here: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/refs/heads/master/system/tools/scripts/btsnooz.py

LEGACY ANSWER:

You can see where your phone is storing the hci log by reading the bt_stack.conf file. Try

adb shell cat /etc/bluetooth/bt_stack.conf

You will see a line that looks like

# BtSnoop log output file
BtSnoopFileName =/sdcard/btsnoop_hci.log <--your file location

It is usually, but not always (depends on the phone) on the root of the sdcard. There is also a line in this configuration file which may reflect if hci logging is actually on or not

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=false

Toggling the 'Enable Bluetooth HCI snoop log' option in the developer options should change it to

# EnableBtSnoop logging function
# valid value : true , false
BtSnoopLogOutput=true

I say "should" because for some phones this doesn't update this file. You should:

1. Read the bt_stack.conf file. See where the HCI log should be and if bt snoop logging is actually enabled or not
2. If developer options say btsnoop_hci logging is on but the bt_stack.conf file says it is off, try power cycling bluetooth and/or your phone.
3. If your phone is rooted, manually set BtSnoopLogOutput=true

If none of the 3 options work, you're out of luck. BT Snoop hci logging is a bit inconsistent across different phones. I've seen a few phones where I just couldn't get it to work not matter what but for the most cases you should be able to get it going. A rooted phone is not a requirement.

Solution 3

On Nexus 5X and Pixel C Android O you have to enable bluetooth, enable HCI snooping in developer settings, disable and reenable bluetooth and reboot.

After that you can get the log by going to developer settings and "take bug report" and get a full log.

The file bt_stack.conf is not changed and there is no new file on /sdcard as on other devices

Solution 4

For a user version Pixel/Nexus, you may not have the permission to pull out /data/misc/bluetooth/logs/btsnoop_hci.log. You can get the hci log like this:

adb shell dumpsys bluetooth_manager
adb bugreport > BUG_REPORT.txt

You will get a BUG_REPORT.txt and zip file. HCI log will be found under FS\data\misc\bluetooth\logs of the zip file.

Solution 5

On a OnePlus 6 (A6003, Android 9) phone (and I believe other OnePlus phones) the location is:

/sdcard/oem_log/btsnoop

This location does not require rooting nor accessing through adb. The log will have a .cfa extension and is in a binary pcap format suitable for analysis with e.g. Wireshark.

View more solutions

Comments

[TwinPrimesAreEz]

This is absolutely not true. There is certainly no need for a phone to be rooted to gather an HCI log

[Lukas]

Alright, thanks for the correction. I usually only work with both rooted and Google-free devices. I have only tried once on a non-rooted phone. Thus I have written "According to my experience" in my answer. I am going to delete my answer.

[PeppeDAlterio]

How can i set set BtSnoopLogOutput=true on a rooted phone?

[TwinPrimesAreEz]

Easiest way would be pull the bt_stack.conf file and then just change 'False' to 'True' in a text editor, then push it back to the correct directory. Note you will probably need to change directory permissions on the phone filesystem to push it back on, which shouldn`t be a problem if you are rooted.

[IgorGanapolsky]

Is there documentation that states HCI snooping requires root?

[IgorGanapolsky]

Every device could be different. Location of this log file is specified in /etc/bluetooth/bt_stack.conf

[IgorGanapolsky]

Mine says BtSnoopLogOutput=false. How to make it true?

[Raulp]

I agree with Lukas. I have seen this only on rooted Phones.Anyone tried with non rooted phone?

[Senseful]

Google Pixel seems to be stuck on BtSnoopLogOutput=false

[DearVolt]

Some other places you may find the bt_stack.conf file are /system/etc/ and /vendor/etc/

[Admin]

I have two non rooted phones, that create this file, but in the different locations. See the next answer to find the right path.

[jbb]

I can confirm that this is the only method that works for me. I'm using the Pixel 2 XL on Android 8.1 Oreo. The "take bug report" feature generates an archive and the log file will be in that archive under FS/data/misc/bluetooth/logs/btsnoop_hci.log

[Fukai]

adb shell dumpsys bluetooth_manager ; adb bugreport > BUG_REPORT.txt

[Dominik]

Some vendors stores this logfile to a non permission directory. clever, isn't? See the parameter "BtSnoopFileName" in bt_stack.conf. And THIS config file can also be on different places. In worst case in a permission denied path. Look in "/etc/bluetooth/" or "/vendor/etc/bluetooth".

[GroovyDotCom]

This is really the most consistent of the methods that works without any rooting, USB connection, etc. and on the most phones.

[GroovyDotCom]

Thanks for the upvote but see also PaulFreund's answer for non-rooting solution.

[Jack Miller]

@Mans: Yes, you can open it using Wireshark.

[ZeroOne]

This worked for my Samsung Galaxy S7. The bug report contains a file FS/data/log/bt/btsnoop_hci.log that can be opened with WireShark.

[Blightbuster]

I found mine in the bugreport zip at: FS\data\misc\bluetooth\logs

[Kamil]

Yes, but it is still not readable. Did you do something with this logs? it isn't utf-8 and i can't decode that with any coding format. i have only IQOS 2.4 ?????[][]???? etc. How to read that?! One plus 7 pro

[rszalski]

@Kamil This is a binary format (pcap) which you can analyse with e.g. Wireshark (wireshark.org) by simply opening the file. I added this to my answer.

[Kamil]

Okay i got it. I just was sure that its plaintext logs. Thank you very much.

[Daniel Alder]

Full fail: my lineageos 16.0 on a s7 hasn't any of the Bt* values set and changing the config results in adb: error: failed to copy 'bt_stack.conf' to '/etc/bluetooth/bt_stack.conf': remote couldn't create file: Read-only file system

[Smeterlink]

@Blightbuster same as you on LineageOS it's on /data/misc/bluetooth/logs/btsnoop_hci.log

[Gumby The Green]

Are you sure you need to reboot? It works for me without doing that.

[rrmoelker]

If you go the btsnooz.py route, note that it's a python2 script. It took me a while to notice. The error related to running with python3 is: "TypeError: write() argument must be str, not bytes"

[Csaba Toth]

OMG dude, thanks so much! I'm exactly with an OP6 and the file is right there as you said. Why is the location not standard?

[Avamander]

This just made the btsnoop_hci.log appear on my Mi 9.

[Jason Steele]

I followed these instructions but Wireshark was unable to analyze the log file created. Has the btsnoop format been changed? (S7 Edge, Android 8.0.0)

[user3067860]

@JasonSteele I was able to use the current (top) instructions and read the log with Wireshark in October. Pixel 2, Android 11. It seems like an unlikely area to make a change since the format is standardized (RFC 1761) and it's not really user facing. Have you verified that there actually was output in the file?

[Jason Steele]

@user3067860 yes, a file was generated. I have a link to it here: drive.google.com/file/d/1Y3544DrhPbI9YxktL6rSWkpAe-YeoPn4/…. I agree that it does sound odd but then I also read somewhere about BlueZ changing (or adding) to the format.

[Cor]

works also for moto g6 with Android 9, thanks a lot