How do I run an adb shell command?

Switch on developer options and USB debugging on the phone, plug it in, then run adb shell from a machine with platform-tools installed — or run adb shell on its own to get an interactive prompt and type the command without the prefix. If the command produces binary output, such as a screenshot, use adb exec-out instead of adb shell: the plain shell service attaches a terminal, which rewrites newline bytes and corrupts the data.

Do adb shell commands need root?

Not the ones on this reference. They run as the shell user, which can manage packages for its own Android user, read most dumpsys services, write the settings provider, inject input and read shared storage. Root is only needed for things this reference deliberately avoids — reading another app's private data (except through run-as on a debuggable build), writing system partitions, or reading /data/anr directly.

Why does the output look different on my phone?

Either the Android version or the manufacturer. Some flags and fields arrived in a specific release, and those are noted per command. The rest is OEM patching, which hits dumpsys hardest: a dump is debug output whose text is whatever the service author last printed, and manufacturers change it and backport their changes. Read fields by name rather than by position, and treat an unfamiliar shape as a difference rather than as a failure.

Can I run this from a browser instead of a terminal?

For many commands, yes — the Web ADB tools on this site talk to a phone over WebUSB from a Chromium-based desktop browser, with no SDK installed and nothing uploaded. Each page links to the tool that runs its command, when one exists. Two limits are worth knowing: only one program can hold the ADB interface at a time, so a desktop adb server has to be stopped first, and adb forward and adb reverse cannot work in a browser at all.

logcat

changes the device

Streams the system log: the running commentary of everything happening on the phone.

Command: adb shell logcat
Commands: System and logs
Risk: changes the device

Syntax

logcat [-v <format>]

Flags and arguments

Token	Meaning
-v <format>	Choose the line format. `threadtime` is the one worth having — date, time, pid, tid, level and tag; `brief` is the terser `I/Tag( 1234):` shape.
-b <buffer>	Which ring buffer to read. `default` covers main, system and crash together, `all` takes everything the shell may open, and any name this build does not recognise is refused by name rather than ignored.
-d	Dump whatever is currently in the buffer and exit rather than streaming. The bound a stream does not have, and the right default for anything automated.
-t <count>	Print the last N lines and exit — it implies `-d`. Cheaper than a full dump on a phone whose buffers are full, and the practical way to grab context after something has already gone wrong.
-m <count>	Stop after printing N lines. It cannot be combined with `-t`, which sets a starting point rather than a ceiling; the command says so and exits instead of guessing which you meant.
-c	Clear the buffer. Destructive and unprivileged: the lines are gone, nothing on the device keeps a copy, and the command does not ask.
-G <size>	Resize a buffer, written as a number followed by a multiplier — a bare number is refused. The new size survives the cable being unplugged, which makes this the most persistent thing on the page.

Examples

```
logcat -v threadtime
```
The format with every field, which is what a viewer should parse.
```
logcat -v brief
```
The older terse shape, still seen in pasted logs.
```
logcat -t 200 -v threadtime
```
The last two hundred lines with every field, then exit — the bounded form to try before opening a stream you then have to stop.
```
logcat -b crash -d -v threadtime
```
Only the crash buffer, dumped once. Where the fatal exception that killed an app is recorded, without the thousands of lines around it.

Reading the output

Sample output

07-26 13:37:01.234  1234  1250 I ActivityManager: Start proc 3062:com.example/u0a234
07-26 13:37:02.010  3062  3062 E MyApp   : java.lang.IllegalStateException: not attached

With `threadtime`: date, time, process id, thread id, one-letter level, tag, then the message after a colon and a space. The tag may contain spaces up to that colon. Not every line is a log record — `--------- beginning of main` and blank lines are the log's own banners, and a viewer should show them rather than try to parse them.

Output fields

Field	Meaning
MM-DD HH:MM:SS.mmm	The device's own local time. No time zone is printed.
pid tid	Process and thread id. Equal numbers mean the main thread.
V D I W E F	Verbose, Debug, Info, Warn, Error, Fatal — in increasing severity.
tag	Whatever the writer chose. The practical way to narrow a log down.
--------- beginning of …	A buffer boundary, not a record.
--------- switch to …	The same banner's second form, printed when a later line comes from a buffer already begun. Reading several buffers at once, these two mark every point where the source changed.

What access it needs

No root, no `adb root`, nothing to switch on in developer options beyond USB debugging — and, unlike most of this reference, that is a deliberate grant rather than a default. `adbd` places `AID_LOG` in the supplementary group list it gives the `shell` user before dropping privileges, which is what lets a cable read every app's lines while an app on the same phone has been able to read only its own since Jelly Bean. The command's own help says the same thing from the other side, noting that only root, log and system users may view logs belonging to other uids. That grant does not cover everything: the `security` buffer is not opened for the shell, and naming it explicitly is the one buffer request that reports its refusal rather than quietly skipping. Reading is unprivileged; three other things this command can do are not read-only and deserve the same care as any write. Clearing a buffer destroys evidence you may want a minute later. Resizing one persists after the cable is unplugged. Writing to a file puts bytes on the device's own storage. None of the three needs root either, so nothing but attention stops a stray flag from throwing away the log you connected to collect. The Android Logcat Viewer streams with none of them and filters in the browser, leaving the buffer exactly as it found it.

Failure messages, decoded

Message	Meaning
logcat: Unexpected EOF!	The reader fell behind the writer, or the logging daemon went away. The message continues for several more lines and names both causes as well as the fix — enlarge the buffer — because on a busy phone this is a throughput problem rather than a crash. Anything consuming this stream has to keep up or bound what it asks for; there is no third option.
logcat: Unable to open log device 'security'.	That buffer exists but is not readable by the shell. It is also the only buffer whose unavailability is reported at all: a buffer selected implicitly and missing is skipped in silence, and only a name you passed yourself produces this line. Nothing about the rest of your request was affected.
logcat: Failed to wait for logd.ready to become true. logd not running?	The logging daemon had not published itself within a second of being asked. Expected during early boot and after the daemon has been restarted; the log itself is not lost, and asking again once the device has finished booting is the entire remedy.
logcat: Unknown buffer 'radio1' listed for -b.	That buffer name is not one this build knows. The available set is not fixed across releases or vendors, so ask the device with `logcat --help` rather than carrying a list over from another phone — and note that the command refuses the whole invocation instead of reading the buffers it did recognise.
logcat: Invalid filter expression in logcat args.	A tag-and-level filter did not parse. The level is a single letter and the tag ends at the colon, so a tag that itself contains a colon cannot be filtered this way at all and has to be matched after the lines have arrived. Nothing was read; the command exits before opening a buffer.

What it changes, and the way back

Reading the log changes nothing. Two flags do: `-c` clears the buffer, so the lines are gone and nothing on the device keeps a copy, and `-G <size>` resizes a buffer, a setting that survives the cable being unplugged. Neither can be undone by a command — for `-G`, write the previous size back, so note it before you change it; for `-c`, capture with `-d` before you clear. Plain `logcat`, `-d`, `-t` and `-v` are read-only.

Version and vendor notes

This streams until something stops it, and on a busy phone that is thousands of lines a minute. Whatever consumes it needs a bound, or it grows until the machine complains.
A long line can be cut in half by the transport, so anything reading this must hold a partial line across chunk boundaries or it will corrupt roughly every hundredth line.
Which buffers exist, and which filter expressions this build understands, varies. Ask the device with `logcat --help` rather than assuming.
Reading other apps' lines is possible only because `adbd` grants the shell the `log` group before it drops privileges. There is no runtime permission to request and no `adb root` needed, which is also why an app cannot reproduce what a cable sees.
Clearing, resizing and writing to a file are all writes hiding on a read command's page, and none of them asks first. A stream that ends the instant it starts is worth checking for a stray clear flag before the device gets the blame.

We have a UI for this

Android Logcat Viewer runs this command over USB and parses what comes back — a Chromium browser, no SDK, nothing uploaded.

Open Android Logcat Viewer

Related commands

Commands that turn up in the same session as logcat.

Command	What it does
dumpsys dropbox	The platform's ring buffer of crashes, ANRs and tombstones — how you read ANR traces without root.
dumpsys activity activities	Which app is in the foreground, and the task and stack structure behind it.
run-as	Runs a command as one app's own uid — the way to read a debug build's private files without root.

More System and logs commands

Command	What it does
top	A one-shot process table: CPU share, memory, state and command line.
getprop	Prints the system properties — the phone's own answer to what it is.

Checked against AOSP, toybox and kernel sources while writing the parsers behind our Web ADB tools. Where a behaviour genuinely varies by Android version or manufacturer, this page says so instead of giving a number that would be wrong on half the phones out there.