ByteScope

dumpsys dropbox

read-only

The platform's ring buffer of crashes, ANRs and tombstones — how you read ANR traces without root.

Command
adb shell dumpsys dropbox
Commands
System services (dumpsys)
Risk
read-only

Syntax

dumpsys dropbox [--print <tag>]

Flags and arguments

TokenMeaning
--print <tag>Print the full text of every entry with that tag. Without a tag you get the index only, which is what you want first.

Examples

  • dumpsys dropbox

    The index: one line per entry, no contents. Cheap.

  • dumpsys dropbox --print data_app_anr

    The actual ANR traces, including the stacks.

  • dumpsys dropbox --print data_app_crash

    Recent app crashes with their exceptions.

Reading the output

Sample output

Drop box contents: 96 entries
Max entries: 1000

2026-07-26 11:04:31 data_app_crash (text, 4321 bytes)
2026-07-26 11:41:02 data_app_anr (compressed text, 12043 bytes)
2026-07-26 12:00:00 SYSTEM_TOMBSTONE (data, 91234 bytes)

The index is a timestamp, a tag and a parenthesised note about how the entry is stored. The tag is the classification: `data_app_*` for user-installed apps, `system_app_*` for preinstalled ones, `*_anr` for an application-not-responding trace, `*_crash` for a Java exception, `*_native_crash` and `SYSTEM_TOMBSTONE` for a native one. The parenthesis is free-form and manufacturers reword it.

Output fields

FieldMeaning
Drop box contents: N entriesHow many entries the buffer holds right now.
<date> <time> <tag>When it happened, in the device's own time zone, and what kind of failure it was.
(text, N bytes)Storage form and size. A size that cannot be read is unknown, not zero.
data_app_anrAn ANR in a user-installed app — the trace you would have looked for in /data/anr.
SYSTEM_TOMBSTONEA native crash the system chose to keep.

What access it needs

Nothing beyond an authorised `adb` connection — no root, no `adb root`, no `su`, and no developer-options switch other than USB debugging itself. The command reaches `DropBoxManagerService.dump`, whose very first statement is `DumpUtils.checkDumpAndUsageStatsPermission(getContext(), TAG, pw)`, so the gate is `android.permission.DUMP` together with the `android:get_usage_stats` app-op — and `com.android.shell`, the package the `shell` user runs as, is granted both `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS` in its own manifest. That asymmetry is the whole reason this page exists: the drop box is read through a permission the shell already holds, while `/data/anr` is read through file permissions it does not, so the same traces are reachable one way and not the other. Two practical consequences follow from where the words come out. A refusal is written to the very same `PrintWriter` the dump itself uses, so it lands on stdout among your entries rather than on stderr, and a script that greps for a tag will simply find nothing and call the phone healthy. But `dumpsys`'s own "service not found" line goes to stderr instead. Keep both streams, and read the first line before you believe a short answer.

Failure messages, decoded

MessageMeaning
Permission Denial: can't dump DropBoxManagerService from from pid=4021, uid=2000 due to missing android.permission.DUMP permission`DumpUtils.checkDumpPermission` assembles this line and returns false, so `dump` stops before listing a single entry. The doubled `from from` is upstream's own typo and is load-bearing if you are matching the line — copy it rather than correcting it. On an ordinary phone this means something has stripped `android.permission.DUMP` from `com.android.shell`, not that the buffer is empty. It goes to the dump's own writer, so you will find it on stdout with everything else.
Can't find service: dropbox`dumpsys` asked the service manager for `dropbox`, got nothing back, and returned `NAME_NOT_FOUND` without ever calling the service. Expected while the device is still booting, before `system_server` has published its services. This one is written to stderr, so a capture that discards stderr sees an empty, apparently successful run.
(No entries found.)The service answered and nothing matched. `dump` prints this whenever its match counter is still zero at the end, which covers both a freshly flashed phone and a date or tag filter of yours that matched nothing. It is a real answer rather than an error: check your filter before concluding the device has never crashed.
(contents lost)The index still remembers the entry, but its body is gone: the record carries the `IS_EMPTY` flag and `dump` moves straight to the next one. A `--print` of that tag returns headers with no stacks under them. The usual cause is the buffer trimming files to stay under its size cap, and nothing recovers them — collect crashes sooner rather than later.
*** SERVICE 'dropbox' DUMP TIMEOUT (10000ms) EXPIRED ***`dumpsys` gave up waiting. Ten seconds is its built-in budget and `-t <seconds>` raises it; a `--print` of a busy tag on a phone that has been up for weeks is the realistic way to hit it. What you already have is a truncated prefix, not a complete dump, so narrow the tag or raise the timeout instead of trusting the tail of what arrived.

Version and vendor notes

  • `/data/anr` is not readable by the shell user on a modern build, which is why this is the answer to "how do I read ANR traces without root": the same traces are in the drop box, and dumpsys will hand them over.
  • Never run `--print` without a tag. On a phone that has been up for a month the output can be tens of megabytes.
  • Tags are conventional rather than enumerated, and vendors add their own. An unfamiliar tag is still readable, just not classifiable.

We have a UI for this

Android ADB Toolbox runs this command over USB and parses what comes back — a Chromium browser, no SDK, nothing uploaded.

Open Android ADB Toolbox

Related commands

Commands that turn up in the same session as dumpsys dropbox.

CommandWhat it does
logcatStreams the system log: the running commentary of everything happening on the phone.
dumpsys activity activitiesWhich app is in the foreground, and the task and stack structure behind it.
run-asRuns a command as one app's own uid — the way to read a debug build's private files without root.

More System services (dumpsys) commands

CommandWhat it does
dumpsys batteryThe battery service's live state: level, status, health, voltage and temperature.
dumpsys diskstatsFree space per partition, a disk write latency check, and a cached per-app breakdown of what is using storage.
dumpsys thermalserviceWhether the phone is throttling, and every thermal zone the hardware layer reports, in degrees Celsius.
dumpsys sensorserviceEvery sensor the phone has, with its vendor, type, rates and batching — plus a buffer of recent readings.
dumpsys meminfoWhich processes are using the most memory, measured as proportional set size.
dumpsys packageEverything the package manager knows about one app: version, paths, flags, install source and per-user state.

Checked against AOSP, toybox and kernel sources while writing the parsers behind our Web ADB tools. Where a behaviour genuinely varies by Android version or manufacturer, this page says so instead of giving a number that would be wrong on half the phones out there.

Frequently asked questions

How do I run an adb shell command?

Switch on developer options and USB debugging on the phone, plug it in, then run adb shell <command> from a machine with platform-tools installed — or run adb shell on its own to get an interactive prompt and type the command without the prefix. If the command produces binary output, such as a screenshot, use adb exec-out instead of adb shell: the plain shell service attaches a terminal, which rewrites newline bytes and corrupts the data.

Do adb shell commands need root?

Not the ones on this reference. They run as the shell user, which can manage packages for its own Android user, read most dumpsys services, write the settings provider, inject input and read shared storage. Root is only needed for things this reference deliberately avoids — reading another app's private data (except through run-as on a debuggable build), writing system partitions, or reading /data/anr directly.

Why does the output look different on my phone?

Either the Android version or the manufacturer. Some flags and fields arrived in a specific release, and those are noted per command. The rest is OEM patching, which hits dumpsys hardest: a dump is debug output whose text is whatever the service author last printed, and manufacturers change it and backport their changes. Read fields by name rather than by position, and treat an unfamiliar shape as a difference rather than as a failure.

Can I run this from a browser instead of a terminal?

For many commands, yes — the Web ADB tools on this site talk to a phone over WebUSB from a Chromium-based desktop browser, with no SDK installed and nothing uploaded. Each page links to the tool that runs its command, when one exists. Two limits are worth knowing: only one program can hold the ADB interface at a time, so a desktop adb server has to be stopped first, and adb forward and adb reverse cannot work in a browser at all.

Would rather click than type? The Web ADB Toolkit runs commands like this from a browser over USB. Or browse every command.