This article covers a Worklet that returns the contents of a device's local amagent.log into the Activity Log, so you can read it without connecting to the endpoint.
Check the simpler options first
Depending on your situation you may not need to build this at all:
- Ask Automox Support. On current agent versions, Support can retrieve a device's agent logs directly while working a case, which is usually the fastest route when a ticket is already open.
-
Use the verified Forensics Worklet. The premium Worklet catalog includes a cross-platform Worklet that reads
amagent.logand returns it to the Activity Log, with versions for Windows, macOS and Linux.
See Retrieving Automox Agent logs for both. Build the Worklet below when you want a specific slice of the log, such as a single date or a bounded number of lines.
Requirements
- A macOS or Linux device with the Automox agent installed
- The agent log at
/var/log/amagent/amagent.log
To create the Worklet, see Creating a Worklet.
Evaluation Code
This is a reporting Worklet, so it should run whenever it is scheduled rather than only when a device is non-compliant:
echo "Log retrieval Worklet, remediation always required." exit 2
Two things to expect rather than treat as faults:
- Devices assigned to this Worklet will permanently show as Pending Update, because the evaluation never returns compliant. That is inherent to a reporting Worklet.
- Use
exit 2rather thanexit 1. Anexit 1from Worklet script content frequently surfaces as Exit Code 124, COMMAND TIMED OUT, even when the script completed normally.
Remediation Code: the most recent lines
This is the option to reach for by default. Adjust the number to suit.
#!/bin/bash
LOG="/var/log/amagent/amagent.log"
if [ ! -f "$LOG" ]; then
echo "Agent log not found at $LOG"
exit 1
fi
echo "===== last 100 lines of $LOG ====="
tail -n 100 "$LOG"
exit 0Remediation Code: a specific date
Confirm the date format in your log before matching on it. Agent log formats have changed across releases, so a pattern that worked previously may match nothing. Print a few lines first to see what you are dealing with:
tail -n 5 /var/log/amagent/amagent.log
Current agent releases write ISO-style dates, so match those:
#!/bin/bash
LOG="/var/log/amagent/amagent.log"
TARGET="2026-07-27"
if [ ! -f "$LOG" ]; then
echo "Agent log not found at $LOG"
exit 1
fi
echo "===== entries for $TARGET ====="
grep "$TARGET" "$LOG" | tail -n 300
exit 0For today's entries without editing the script each time:
grep "$(date +%F)" "$LOG" | tail -n 300
Older agent releases wrote dates in YYYY/MM/DD form. If the ISO pattern returns nothing and the log is from an older agent, match that format instead:
grep "2026/07/27" "$LOG" | tail -n 300
Piping through tail bounds the result. A busy day can produce more log lines than is useful to read in the Activity Log.
Remediation Code: the entire log
Use this only on a device you have already narrowed down to. The agent log can be large, and a full dump is slow to return and awkward to read in the Activity Log, where it may be truncated.
#!/bin/bash
LOG="/var/log/amagent/amagent.log"
if [ ! -f "$LOG" ]; then
echo "Agent log not found at $LOG"
exit 1
fi
LINES=$(wc -l "$LOG" | awk '{print $1}')
echo "===== $LOG ($LINES lines) ====="
cat "$LOG"
exit 0The line count in the header tells you at a glance whether the output was complete.
Notes
- Do not write to a temporary file. Each command above prints straight to standard output, which is what reaches the Activity Log. Staging the output into a file first adds nothing, and appending to a file that is never removed causes the output to grow with every run.
-
Some agent releases also write
amagent_debug.login the same directory, which carries more detail. If the standard log does not explain the behavior you are chasing, check whether that file is present. - Pair the log with a timeframe. When sending output to Support, include the approximate time the problem occurred so the entries can be lined up against the console.