device-log-monitor

name	device-log-monitor
description	Structured log capture and monitoring for Android device debugging. Use when the user says "check logs", "monitor logcat", "what's happening on device", "debug hook", or after deploying an Xposed module to verify it's working. Includes LSPosed/Xposed log access and UI state inspection.

Device Log Monitor

Use this skill to capture, filter, and analyze Android device logs for debugging.

Core Rules

• Always check device connection first with adb devices.
• Use tag-specific grep filters to avoid noise — never dump raw logcat without filtering.
• Capture logs to timestamped files for later reference.
• For Xposed modules, check LSPosed logs separately.

Log Capture Modes

1. Real-time Monitoring

Monitor logs in real-time with tag filtering:

adb logcat -c && adb logcat | grep -E "TAG1|TAG2|TAG3"

Common tag sets by project:

PixelWatchSpoof (Xposed):

SppAuthHook|BindDevice_|onBindSuccess|onRequestDevice|mViewModel|requestDeviceList|getBindInfo|connectDevice

MotoBuds:

MotoBuds|BluetoothGatt|BudsProtocol|AudioService

General Android:

AndroidRuntime|System.err|ActivityManager|PackageManager

2. Snapshot Capture

Capture recent logs with timestamp:

adb logcat -d -t '1000' > /tmp/logcat_$(date +%Y%m%d_%H%M%S).log

Then filter:

grep -E "pattern1|pattern2" /tmp/logcat_*.log | tail -50

3. Xposed/LSPosed Logs

Access LSPosed module logs:

adb shell "su -c 'ls -t /data/adb/lspd/log/modules_*.log | head -1'"

Read latest log:

adb shell "su -c 'cat $(adb shell \"su -c 'ls -t /data/adb/lspd/log/modules_*.log | head -1'\" 2>/dev/null)'"

Filter for specific module:

adb shell "su -c 'cat /data/adb/lspd/log/modules_*.log'" | grep -E "ModuleName|HookClass" | tail -50

4. UI State Inspection

Dump current UI hierarchy:

adb shell "uiautomator dump /sdcard/ui.xml 2>/dev/null && cat /sdcard/ui.xml" | grep -o 'text="[^"]*"' | sort -u

Full XML dump for analysis:

adb shell "uiautomator dump /sdcard/ui.xml" && adb pull /sdcard/ui.xml /tmp/ui_dump.xml

Workflow

1. Check device — adb devices must show connected device
2. Clear old logs (optional) — adb logcat -c for fresh capture
3. Start capture — choose mode based on user request:
   • Real-time: adb logcat | grep -E "tags..."
   • Snapshot: adb logcat -d -t '500' > /tmp/log_<timestamp>.log
   • LSPosed: adb shell "su -c 'cat ...'"
   • UI: adb shell "uiautomator dump ..."
4. Filter and analyze — extract relevant lines, count occurrences, identify patterns
5. Report findings — structured summary with:
   • Log file path (if saved)
   • Total lines captured
   • Error/warning count
   • Key events in chronological order
   • Anomalies or unexpected behavior

Common Debug Patterns

Xposed Module Not Loading

adb shell "su -c 'cat /data/adb/lspd/log/modules_*.log'" | grep -E "Module|load|enable" | tail -20

Hook Not Firing

adb logcat -d | grep -E "HookClass|HookMethod|beforeHookedMethod|afterHookedMethod" | tail -20

Bluetooth Connection Issues

adb logcat -d | grep -E "BluetoothGatt|BluetoothDevice|BondStateMachine|SppAuth" | tail -30

App Crash Investigation

adb logcat -d | grep -E "FATAL|AndroidRuntime|Exception" | tail -30

Log File Management

• Save logs to /tmp/logcat_<project>_<timestamp>.log
• Keep max 5 recent log files per project
• Delete logs older than 7 days: find /tmp -name "logcat_*.log" -mtime +7 -delete

Required Output

Always output:

1. Device connection status
2. Capture mode used
3. Total lines captured
4. Filter applied (tags/patterns)
5. Key findings (errors, warnings, notable events)
6. Log file path (if saved to disk)