Retrieving Automox Agent logs

Issue

A device's Automox agent log (amagent.log) is needed for troubleshooting, but direct access to the endpoint is unavailable or undesirable.

Environment

• Automox agent 2.6 or later (for Support-side log retrieval)
• Windows (this article's examples; verified worklets exist for Windows, macOS, and Linux)

Overview

There are three supported ways to obtain a device's amagent.log without logging on to the endpoint, listed simplest first:

1. Ask Automox Support to retrieve the agent logs (Automox agent 2.6 and later).
2. Run the verified Automox Forensics Premium worklet that returns the log to the Activity Log.
3. Create a custom Worklet that reads and returns the log.

Option 1 — Request the logs from Automox Support

With Automox agent 2.6 and later, Automox Support can retrieve a device's agent logs directly while working a case. When a support ticket is already open, this is often the quickest path — provide the device name/ID and the timeframe of the issue.

Option 2 — Run the verified Forensics worklet

The Automox Premium worklet catalog includes a verified, cross-platform worklet that reads amagent.log and outputs its contents to the Activity Log. Open the one matching the device's operating system:

• Windows — Forensics — Get Automox Agent Log (amagent.log)
• MacOS — Forensics — Get Automox Agent Log (amagent.log)
• Linux — Forensics — Get Automox Agent Log (amagent.log)

To use it:

1. Open the catalog link above for the device's operating system (or, in the console, open the worklet catalog and search for Get Automox Agent Log).
2. Add the worklet to the organization.
3. Run the worklet against the target device.
4. Open the run in the Activity Log to read the returned log contents.

These are premium catalog worklets; availability depends on the organization's plan or entitlement.

Option 3 — Create a custom Worklet

Where a purpose-built worklet is preferred, create a Worklet that reads the log and returns it to the Activity Log:

• Evaluation code: exit 0 (ensures remediation only occurs when run manually).
• Remediation code: read the log with Get-Content (Windows).

Full log:

Get-Content "C:\ProgramData\amagent\amagent.log"

Most recent entries only:

Get-Content "C:\ProgramData\amagent\amagent.log" -Tail 1000

Run the Worklet against the device, then open the run in the Activity Log to read the returned text.

Notes

• For older issues, retrieve the full log. amagent.log rotates and older entries roll off, so a -Tail 1000 may miss the relevant window. Return the full file (or collect the archived/rotated log files) when the incident is not recent.
• Prefer a worklet over piping to disk with Get-Content … | Out-File, which produces UTF‑16 output that is awkward to read.
• The default Windows log path is C:\ProgramData\amagent\amagent.log.