Device Action: Trigger Enhanced Logging
Enhanced Logging lets AppleCare collect detailed diagnostic logs directly from a device to help diagnose an issue, without requiring the device user to manually run a sysdiagnose. When AppleCare provides a token for a support case, admins can send that token to the device from SimpleMDM to start the log collection and upload process.
Apple documentation for this command can be found here:
- Apple Developer Documentation - TriggerEnhancedLogCollection Command
- Apple Developer Documentation - CancelEnhancedLogCollection Command
Supported platforms
Trigger Enhanced Logging is available for supervised iOS, iPadOS, macOS, and tvOS devices running OS 27 or later. It is not available on devices enrolled via User Enrollment, and is not supported on watchOS or visionOS.
On macOS, the device must also be registered for user-level MDM communication, since Apple delivers this command over the user channel on that platform.
How to trigger enhanced logging
- In SimpleMDM, navigate to the device's Device Details page.
- Click "Actions", then select "Trigger Enhanced Logging".
- Enter the AppleCare Token provided by Apple support for the case.
- Click "Trigger Enhanced Logging" to send the command to the device.
Once sent, the device starts enhanced logging and requests the user's consent as needed. SimpleMDM does not collect or store the logs itself — they are uploaded directly to Apple's support servers as part of the AppleCare case.
Viewing enhanced logging status
While enhanced logging is active on a device, a "Enhanced Logging" section appears on the Device Details page showing the current state:
- Waiting for User Consent: The device is waiting for the user to approve starting the log collection.
- Collecting Logs: The device is actively gathering diagnostic logs.
- Waiting for Additional User Input: Apple's process needs an additional response from the user before continuing.
- Waiting for Upload Consent: The device is waiting for the user to approve uploading the collected logs.
- Uploading Logs: The logs are being uploaded to Apple's support servers.
- Logs Successfully Uploaded: The logs finished uploading and the case can proceed with AppleCare.
- Logs Collection or Upload Failed: The process failed before logs could be collected or uploaded.
- Cancelled: The session was cancelled from SimpleMDM before it completed.
- Declined by User: The device user declined to consent to logging or upload.
Canceling an active session
While a session is in progress (any state other than "Logs Successfully Uploaded," "Logs Collection or Upload Failed," "Cancelled," or "Declined by User"), a "Cancel Enhanced Logging" option is available from the device's Actions menu and from the Enhanced Logging status panel. Selecting it sends a request to stop the active log collection session.
Audit logs and device logs
Triggering or canceling enhanced logging is recorded in the account's audit log, along with the outcome of the command once the device responds. The device's own log also reflects status changes as the device progresses through the collection and upload process, along with a message once the request is triggered or canceled successfully.
Filtering devices by enhanced logging state
An "Enhanced Logging State" filter is available under dynamic device filters, allowing admins to find devices matching a specific state (for example, devices where an upload has failed or is still waiting on user consent).
Notes
- An AppleCare token is required to trigger enhanced logging. it is provided by Apple support as part of a diagnostic case, not generated by SimpleMDM.
- SimpleMDM only relays the command and reports status; the actual log collection, user consent prompts, and upload happen on the device and are sent directly to Apple.
