Where does Android store shutdown logs?

Question

I know that the boot up log can be obtained by pulling out contents of kmsg or dmesg through ADB.
But I'm not aware of how to retrieve the shutdown logs in Android as there's no /var folder in Android (place where most desktop linux distros generally store their shutdown logs).

So how can I obtain the shutdown logs in Android?

Answer 1

Look in some locations such as these:

/proc/last_kmsg
/data/tombstones/
/data/dontpanic/
/data/system/dropbox/

(This list isn't strictly kernel logs, including framework and application logs too, which are also sometimes of interest)

Answer 2

TL;DR:
Run command through adb that copies logcat and proc/kmsg to a file and keep it running even when adb disconnects with nohup, disown or setsid. Probably needs busybox, needs root and adb root, too.
setsid cat proc/kmsg > /sdcard/kmsg.txt &
and
logcat -v long -f /sdcard/logcat.txt (somehow only works without setsid)

Or add normal copy commands to some startup script.
/TL;DR

You can constantly copy proc/kmsg and logcat to a file on your android device or a microSD card to get the logs even after adb disconnects.

You need root access and adb root access for this to work. For the latter, use the setting in the developer options if you have a custom rom or the adbd insecure app.

After using adb shell to get your android shell, type su to get superuser access.

Then you not only need to put an ampersand (&) after the command but also make sure that the command keeps running after adb disconnects. That is done by nohup, disown or setsid (see here for usage).
If it doesn't work because you don't have these commands, you need to install busybox.
See my question here.

See here for how to get logcat and kernel logs and print it to some file or merge it. See developer.android.com/tools/help/logcat.html for parameters for the logcat command.

In the end you could have a command like setsid cat proc/kmsg > /sdcard/kmsg.txt & for the kernel messages.

For logcat you could have one of the following commands: logcat -v long -f /sdcard/logcat.txt or logcat -v long > /sdcard/logcat.txt

I don't know why, but sometimes it didn't work with setsid and just didn't copy continuously but stopped shortly after executing the command. In these situations, it also showed up when entering jobs, which it didn't otherwise. Then it just worked without setsid, it stayed alive after disconnecting and reconnecting. I guess you must just try when the file does keep getting larger. If someone figured out why it is behaving like it is... let me know and I'll edit the answer.

Probably adding the commands to a startup script could be a solution for some, too.

Hope this helps.

fightcookie