Back to top

Use the agent app

Last updated September 6th, 2023

The Knox Asset Intelligence agent runs on the device and is responsible for collecting device information to send to the Knox cloud server.

When a device user launches the agent, the main screen displays the agent version, name of the group the device belongs to, and enrollment status.

kai agent screen

The following actions are available:

  • Device status — Displays device information, including the IMEI and firmware version.
  • Error reports — Generates system logs to submit to the Knox Asset Intelligence console. The device user is prompted to enter a category and description before submission.
  • Diagnostics — Displays Wi-Fi, battery, and app information related to the device.
  • Legal information — Displays legal disclaimers pertaining to the use of Knox Asset Intelligence.
  • Open source licenses — Displays the open source licenses used by Knox Asset Intelligence.


Per Google’s design, whenever the Knox Asset Intelligence agent is active, a Knox Asset Intelligence is running notification displays in the notification drawer. You can hide it through the device’s notification settings.

Device status

When the device user selects Device status from the agent’s main screen, the device’s information is shown. As an IT admin, you can use this information to quickly verify and troubleshoot issues without requesting device logs every time.

The device information includes the following:

  • Model name
  • Model numbe
  • IMEI
  • Serial numbe
  • Android OS version
  • Firmware version
  • Android security patch level
  • Knox version
  • Display resolution
  • Display density
  • Wi-Fi MAC address
  • Bluetooth address
  • Storage
  • RAM

Error reports

When the device user selects Error reports, system debug logs are generated that can be uploaded to your Knox Asset Intelligence console. The debug logs contain system diagnostics information and system message logs that can help you identify the root cause of an issue. You can also capture tcpdump logs for advanced network troubleshooting between device and app servers. Any uploaded device debug logs are deleted from the Knox Asset Intelligence servers after 30 days by default.

Before submission, the device user must first select one of the following categories for the error report:

  • All
  • Battery
  • App
  • Wi-Fi
  • Device operation
  • Network (TCPDUMP)

Then, they’re prompted to enter a detailed description for the issue. The description is limited to 500 characters.

Once the two fields are filled, the device user can then send the logs to the Knox cloud server. The logs can’t be submitted if either one of the fields is empty. After the device user successfully sends the log file, you can view it in the Diagnostic device logs menu on the Knox Asset Intelligence console.

Send a tcpdump log


This feature is only available on devices running Android 12 (S) or higher.

To help you troubleshoot more complicated network issues, Knox Asset Intelligence uses the tcpdump tool to get network traffic data directly from the device, which device users can then send to you as a tcpdump log. This log records all packet information that the device is transmitting or receiving over the network.

If the device user selects Network (TCPDUMP) as the error category, after they enter your description and tap Send, they’re prompted to confirm whether they want to start capturing a tcpdump log. They also need to acknowledge that some sensitive information might also be captured before they can continue.

If they tap Start capturing, the device user then needs to reproduce the issue they encountered within 5 minutes. Floating action buttons are shown with options to cancel or stop the capturing process. Tapping the cancel button or exceeding the 5-minute time limit discards the log and ends the capture session, and you’ll see a Couldn’t reproduce status in the console.

After the device user replicates the situation the issue occurred in, they can tap the stop button to end log capturing. They’re then asked whether they want to send the log to you, and are given options to Start over or Send.

Tcpdump logs are deleted after 30 days by default, but you have the ability to delete them manually in the Knox Asset Intelligence console.


To help troubleshoot issues further, device users can use the agent’s Diagnostics feature to get more detailed information about their device’s Wi-Fi, battery, and app-related behavior, then take actions to share this information or send error reports to IT admins for further analysis.

To begin, the device user needs to tap the Diagnostic button on their app home screen, then tap the option that they want to perform diagnostics with:

  • Wi-Fi
  • Battery
  • Apps
  • Mobile network

kai agent diagnostics screen


After selecting Wi-Fi, two tabs are available at the bottom of the screen.

  • Status — Displays the signal strength, band, SSID, signal, IP, device MAC address, and access point MAC address of device’s current Wi-Fi connection. If Wi-Fi roaming is detected, additional roaming information is displayed. The signal strength is shown in real-time as a graph, with three statuses indicating the network latency. The status ranges are as follows:

    Status Strength
    Excellent -67 dBm or higher
    Very good -68 dBm to -70 dBm
    Okay -71 dBm to -80 dBm
    Not good -81 dBm to -90 dBm
    Unusable -91 dBm or lower
  • Test — Allows the device user to send various commands to the Wi-Fi network to test for connectivity issues. The results of these tests can be shared with you for troubleshooting purposes.

    • Single Ping — Sends a single ICMP (Internet Control Message Protocol) echo request to the network host. After the device user enters a DNS or IP address, the ping result is returned. For example, if com is entered as the DNS, it tries to request three packets at once. Assuming receives three packets, the ping result shows 3 packets transmitted, 3 received, 0% packet loss. No packet loss indicates that data is reaching its destination properly. There may be a slight delay before the results are returned.
    • Continual Ping — Sends a looping ICMP echo request to the network host, which you can configure the settings for. After the device user enters a DNS or IP address, the ping result is returned. For example, if com is entered as the DNS, it continuously requests one packet at a time. Assuming receives six packets, the ping result shows Sent: 6, Received: 6, Missed: 0. No packet loss indicates that data is reaching its destination properly. There may be a slight delay before the results are returned.
    • NSLookup — Queries the DNS servers for the domain mapping to the IP address. After the device user enters a DNS or IP address, the DNS records for the domain name are returned. For example, if com is entered as the DNS, its host name, canonical name, IP address, and network latency are shown.
    • Network status — Displays the details of the device’s connected network, including the host name, domain, IP address, mask, broadcast, gateway, DHCP info, WLAN DNS, and lease time. If the device is using a proxy, that information is also displayed.
    • Scan SSID — Displays the signal strength, access point MAC address, and band of the SSID the device is currently connected to.
    • Known network — Displays a list of all Wi-Fi networks the device has previously connected to.

The device user can also generate and send debug logs to you by selecting Error report in the top-right corner of the screen.

Change the continual ping test settings

To change the continual ping settings, the device user can tap the settings next to Continual Ping. The following settings are available:

  • Count — The total number of packets to request. The default value is 10, but a number from 4 to 1000 can be entered.
  • Interval (ms) — The interval of time, in milliseconds, between successive packet transmissions. The default value is 1000, but a number from 200 to 2000 can be entered.
  • Timeout (ms) — The length of time, in milliseconds, that a response needs to be received within before a connection timeout is reported. The default value is 500, but a number from 10 to 1000 can be entered.
  • Max TTL — The maximum amount of time, or time to live (TTL), in seconds, that a packet can exist in a network before being discarded by the router. The default value is 64, but a number from 49 to 255 can be entered.
  • Packet size — The size of the packet to request, in bytes. The default value is 64, but a number from 4 to 1472 can be entered.

If the device user sets Packet size as 10, Interval (ms) as 1000 ms, and Timeout (ms) as 500 ms, 10 pings are sent and the interval between each ping is set to 1000 ms. A successful test requires all 10 pings to be received within 500 ms each.

The ping test continues even if the device user leaves the screen, but they can stop it at any time by tapping the stop button. Otherwise, the test automatically stops once the set conditions are met. A notification is also displayed in the notification bar for the duration of the test, which the user can tap to return to the test screen.


When the device user selects Battery from the Diagnostics menu, the Status and History tabs are shown at the bottom of the screen.


The Status tab provides information on the following battery-related data points:

  • Battery status — Indicates whether the device is connected to a charger or not.
  • Battery level
  • State of health — The overall health of the device’s battery, defined as Good, Normal, or Bad.
  • Battery voltage
  • Charger type
  • Charger plug
  • Battery’s rated capacity
  • Battery health — The percentage of the battery’s original charge it can currently hold.
  • Time until battery fully drained/Time until battery fully charged — When the device is not charging, the first option is shown. Otherwise, the second option is shown.
  • Current battery charge
  • Current battery capacity
  • Average current
  • Current right now — When the device is charging, displays the charging current in milliamperes (mA).

Battery data screen

Device users can also generate and send debug logs to you by tapping Error report in the top-right corner of the screen.


The History tab shows historical information about how the device’s battery was used, spanning the last 14 days. An entry is logged every time the battery charge increases, and includes the following data points:

  • Date
  • Timestamp
  • Battery percentage
  • In and out amperage
  • Battery voltage
  • Charger plug
  • Charge type
  • Time until fully charged

The device user can tap and hold an entry, then tap Remove data to hide that entry. Note that any entries deleted this way can’t be restored. To see more battery usage information from the last 7 days, the user can also tap Settings (gear icon) in the top right corner to view the following additional options:

  • Battery usage trend takes the user directly to Device care in the device settings.
  • Share with your admin allows users to upload a log file — containing the battery’s charging history — to the Knox Asset Intelligence console for further analysis. The log file contains the following information:
    • Date — The date that the log was created
    • Timestamp — The time the log event occurred.
    • Battery charge (%) — The battery charge percentage at the time of log creation.
    • In and out Amperage (mA) — The battery current/amperage (in milliamps) measured at each log event. Negative values indicate battery discharging, while positive values indicate battery charging.
    • Battery Voltage (mV) — the battery voltage level at time of log event
    • Charger Plug — the type of plug used to charge the battery at time of event. Available options:
    • AC — battery was plugged in to a wall charger.
    • Wireless — battery was plugged in to a wireless charger (charging station).
    • USB — battery was plugged in to a computer’s USB port.
    • Pogo — device was plugged in to a charging dock with a Pogo connection (Android 13 and higher)
    • N/A — Device was not plugged in.
    • Charge Type — the type of charge occurring on the battery at time of log event:
    • USB — device was charging through USB power.
    • Normal — device was charging at a normal charge rate through AC power.
    • FAST (AFC) — device was charging at a fast rate using Samsung’s Adaptive Fast Charge technology.
    • FAST (PD) — also known as USB Power Delivery (PD). Device was being charging at a fast using a PD-enabled USB-C port.
    • Pogo — device was charging through a charging dock with a Pogo connection (Android 13 and higher).
    • Wireless — device was charging through a wireless charging station.
    • N/A — device was not charging.
    • Time until fully charged — the remaining time until battery was going to be fully charged, at time of log event.


If the device user selects Apps from the Diagnostics menu, they will see two tabs at the bottom of the screen: Usage (default) and Event.

Usage tab

The Usage tab displays the top 5 apps that consume the most battery and network resources on the device. When the device user selects the Usage tab, they will also see two tabs near the top of the screen for Battery and Network respectively. Tap either of the top tabs to view the top 5 apps that consume the most resources.

Events tab

The Events tab lets you know which apps have cause the most issues on the device. The following three categories of app issues are available:

  • Application not responding
  • Force close
  • Abnormal event

Device users can select a category to see a list of apps that reported that issue type over the last 24 hours.

For each app, the app’s version number, as well as the number of times the issue occurred are shown. If an app reported multiple issue types, the total number of occurrences is shown along with a breakdown by issue type. Users can also send a debug log file by tapping Error report in the top right corner of the screen.

Mobile network

Device users can view mobile network diagnostic information like total data consumption for each SIM card in their device, and network signal strength. To view mobile network diagnostic information, go to the app home screen, tap Diagnostics > Mobile network.

kai agent mobile diagnostics screen

On the Mobile network screen, a chart provides the signal strength and status over the last 10 seconds, with each segment of the chart representing one second. You’ll see the following statuses on the chart:

  • Excellent : -67dBm or higher
  • Very good : -68dBm to -70dBm
  • Fine : -71dBm to -80dBm
  • Not good : -81dBm to -90dBm
  • Unusable : -91dBm or lower
  • N/A : lower than -140dBm or No data.

Below the chart, users can view their network information like the carrier’s name, network mode, and signal strength.

Is this page helpful?