try {
     AuditLog.a(AuditLog.AUDIT_LOG_GROUP_APPLICATION, false, android.os.Process.myPid(), this
             .getClass().getSimpleName(),
             "Pairing bluetooth failed. Unable to get device address.");
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: This API can only be called statically. The context used for log will always be the administrator's one, even if calling this API for container.

 try {
     AuditLog.c(AuditLog.AUDIT_LOG_GROUP_EVENTS, false, android.os.Process.myPid(),
             this.getClass()
                     .getSimpleName(),
             "Pairing bluetooth failed. Unable to get device address.");
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: This API can only be called statically. The context used for log will always be the administrator's one, even if calling this API for container.

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     boolean ret = auditLog.disableAuditLog();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.disableAuditLog();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     boolean ret = auditLog.disableIPTablesLogging();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditlog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.disableIPTablesLogging();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE 1: Since Android N(7.0), administrator must dump to current application filesystem, and then move it to Sdcard directory, if necessary. This API is not able to write directly on Sdcard (internal or external) anymore due to Android security limitation.

NOTE 2: Since Android R(11.0), if dump operation is done by a profile owner either at work profile or its parent (user 0) on a company-owned device, some parent profile logs will be redacted/removed due to privacy concern.

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 if (auditLog.isAuditLogEnabled()) {
 
     // Set the Filter for Severity Level
     String filterRegex = "*[1-5]/[3]/[0-1]/* .*[1-5]/[3]/[0-1]/.*";
 
     // Set the Begin Time for the output logs
     mBeginDate = new Date();
     long dateBegin = mBeginDate.getTime();
 
     // Set the End Time for the output logs
     mEndDate = new Date(mBeginDate.getTime() + 50000);
     long dateFinal = mEndDate.getTime();
 
     // Dump path for PartialFile into application filesystem
      File dFile = mContext.getFileStreamPath("dump.gz");
 
     // Check if the file already exist
     if (dFile.exists()) {
         dFile.delete();
     }
     // Create new file
     try {
         dFile.createNewFile();
     } catch (IOException e) {
         errorMessage = "Dump failed: " + e.getMessage();
         Log.e(TAG, errorMessage);
     }
     ParcelFileDescriptor outputFile = null;
 
     try {
         outputFile = ParcelFileDescriptor.open(dFile, ParcelFileDescriptor.MODE_READ_WRITE
                 | ParcelFileDescriptor.MODE_CREATE | ParcelFileDescriptor.MODE_TRUNCATE);
 
         boolean ret = auditLog.dumpLogFile(dateBegin, dateFinal, filterRegex, outputFile);
 
     } catch (FileNotFoundException e) {
         Log.w(TAG, "FileNotFoundException: " + e);
     } catch (SecurityException e) {
         Log.w(TAG, "SecurityException: " + e);
     }
 } else {
     Log.w(TAG, "AuditLog is not Running ");
 }

 // Code sample to move the dump file from application internal filesystem to the app folder created in external storage
 String finalPath = mContext.getExternalFilesDir(null).getPath() + "/dump_10278.gz";
 File finalFile = new File(finalPath);
 String mDataFilePath = dFile.getAbsolutePath();
 String mSdcardFilePath = finalFile.getAbsolutePath();
 InputStream in = null;
 OutputStream out = null;

 try { 
    in = new FileInputStream(mDataFilePath);
    out = new FileOutputStream(mSdcardFilePath);

    byte[] buffer = new byte[1024];
    int read;
    while ((read = in.read(buffer)) != -1) {
 	      out.write(buffer, 0, read);
    }
 
    // write the output file
    out.flush();

    // delete the original file
    new File(mDataFilePath).delete();

 }
 
 catch (FileNotFoundException e1) {
     Log.e(TAG, e1.getMessage());
 } catch (IOException e2) {
     Log.e(TAG, e2.getMessage());
 }
 finally {
     if (out != null) {
         out.close();
     }
     if (in != null) {
         in.close();
     }
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 if (auditLog.isAuditLogEnabled()) {
 
     // Set the Filter for Severity Level
     String filterRegex = "*[1-5]/[3]/[0-1]/* .*[1-5]/[3]/[0-1]/.*";

     // Set the Begin Time for the output logs
     mBeginDate = new Date();
     long dateBegin = mBeginDate.getTime();

     // Set the End Time for the output logs
     mEndDate = new Date(mBeginDate.getTime() + 50000);
     long dateFinal = mEndDate.getTime();

     // Dump path for PartialFile into application filesystem
     File dFile = mContext.getFileStreamPath("dump.gz");

     // Create new file
     try {
         dFile.createNewFile();
     } catch (IOException e) {
         errorMessage = "Dump failed: " + e.getMessage();
         Log.e(TAG, errorMessage);
     }

     // Check if the file already exist
     if (dFile.exists()) {
         dFile.delete();
     }

     ParcelFileDescriptor outputFile = null;
     try {
         outputFile = ParcelFileDescriptor.open(dFile, ParcelFileDescriptor.MODE_READ_WRITE
                 | ParcelFileDescriptor.MODE_CREATE | ParcelFileDescriptor.MODE_TRUNCATE);

         boolean ret = auditLog.dumpLogFile(dateBegin, dateFinal, filterRegex, outputFile);

     } catch (FileNotFoundException e) {
         Log.w(TAG, "FileNotFoundException: " + e);
     } catch (SecurityException e) {
         Log.w(TAG, "SecurityException: " + e);
     }
 } else {
     Log.w(TAG, "AuditLog is not Running ");
 }

 // Code sample to move the dump file from application internal filesystem to the app folder created in external storage
 String finalPath = mContext.getExternalFilesDir(null).getPath() + "/dump_10278.gz";
 File finalFile = new File(finalPath);
 String mDataFilePath = dFile.getAbsolutePath();
 String mSdcardFilePath = finalFile.getAbsolutePath();
 InputStream in = null;
 OutputStream out = null;

 try { 
    in = new FileInputStream(mDataFilePath);
    out = new FileOutputStream(mSdcardFilePath);

    byte[] buffer = new byte[1024];
    int read;
    while ((read = in.read(buffer)) != -1) {
 	      out.write(buffer, 0, read);
    }
 
    // write the output file
    out.flush();

    // delete the original file
    new File(mDataFilePath).delete();
 }
 
 catch (FileNotFoundException e1) {
     Log.e(TAG, e1.getMessage());
 } catch (IOException e2) {
     Log.e(TAG, e2.getMessage());
 }
 finally {
     if (in != null) {
         try {
             in.close();
         } catch (IOException e) {
             Log.e(TAG, e.getMessage());
         }
     }
     if (out != null) {
         try {
             out.close();
         } catch (IOException e) {
             Log.e(TAG, e.getMessage());
         }
     }
 }
 

 try {
     AuditLog.e(AuditLog.AUDIT_LOG_GROUP_SYSTEM, false, android.os.Process.myPid(), this
             .getClass().getSimpleName(),
             "Pairing bluetooth failed. Unable to get device address.");
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: This API can only be called statically. The context used for log will always be the administrator's one, even if calling this API for container.

NOTE: Since KNOX 2.6, this policy is no longer supported by Chrome.

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     boolean ret = auditLog.enableAuditLog();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.enableAuditLog();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Since Android R(11.0), if this value is turned on by a profile owner either at work profile or its parent (user 0) on a company-owned device, only the iptable events generated at work profile will be logged due to privacy concern.

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     boolean ret = auditLog.enableIPTablesLogging();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.enableIPTablesLogging();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     AuditLogRulesInfo ret = auditLog.getAuditLogRules();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     AuditLogRulesInfo ret = auditLog.getAuditLogRules();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 try {
     int size = auditLog.getCriticalLogSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     int size = auditLog.getCriticalLogSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     int size = auditLog.getCurrentLogFileSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     int size = auditLog.getCurrentLogFileSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 try {
     int size = auditLog.getMaximumLogSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     int size = auditLog.getMaximumLogSize();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.isAuditLogEnabled();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.isAuditLogEnabled();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 try {
     boolean ret = auditLog.isIPTablesLoggingEnabled();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 @knox
 NOTE: Since KNOX 2.6, AuditLog policy is available for Container.


 
 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
              .getKnoxContainerManager(containerID);
 AuditLog auditlog = kcm.getAuditLogPolicy();

 try {
     boolean ret = auditLog.isIPTablesLoggingEnabled();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 try {
     AuditLog.n(AuditLog.AUDIT_LOG_GROUP_EVENTS, false, android.os.Process.myPid(),
             this.getClass()
                     .getSimpleName(),
             "Pairing bluetooth failed. Unable to get device address.");
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: This API can only be called statically. The context used for log will always be the administrator's one, even if calling this API for container.

NOTE: Since Android R(11.0), if kernel value is turned on by a profile owner either at work profile or its parent (user 0) on a company-owned device, kernel events will not be logged due to privacy concern.

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 List<Integer> groups = new ArrayList<Integer>();
 groups.add(AuditLog.AUDIT_LOG_GROUP_APPLICATION);
 groups.add(AuditLog.AUDIT_LOG_GROUP_SECURITY);
 AuditLogRulesInfo auditLogRulesInfo = new AuditLogRulesInfo(AUDIT_LOG_SEVERITY_ALERT,
         AuditLogRulesInfo.AUDIT_LOG_OUTCOME_RULES_SUCCESS, groups, false);
 
 try {
     boolean ret = auditLog.setAuditLogRules(auditLogRulesInfo);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 List<Integer> groups = new ArrayList<Integer>();
 groups.add(AuditLog.AUDIT_LOG_GROUP_APPLICATION);
 groups.add(AuditLog.AUDIT_LOG_GROUP_SECURITY);
 AuditLogRulesInfo auditLogRulesInfo = new AuditLogRulesInfo(AUDIT_LOG_SEVERITY_ALERT,
         AuditLogRulesInfo.AUDIT_LOG_OUTCOME_RULES_SUCCESS, groups, false);

 try {
     boolean ret = auditLog.setAuditLogRules(auditLogRulesInfo);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 int percent = 70;
 boolean ret = false;
 try {
     if (auditLog.isAuditLogEnabled()) {
         ret = auditLog.setCriticalLogSize(percent);
     } else {
         Log.w(TAG, "AuditLog is not Running ");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 @knox
 NOTE: Since KNOX 2.6, AuditLog policy is available for Container.


 
 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
              .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 int percent = 70;
 boolean ret = false;
 try {
     if (auditLog.isAuditLogEnabled()) {
         ret = auditLog.setCriticalLogSize(percent);
     } else {
         Log.w(TAG, "AuditLog is not Running ");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 AuditLog auditLog = ekm.getAuditLogPolicy();
 
 int percent = 85;
 boolean ret = false;
 try {
     if (auditLog.isAuditLogEnabled()) {
         ret = auditLog.setMaximumLogSize(percent);
     } else {
         Log.w(TAG, "AuditLog is not Running ");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance(context)
         .getKnoxContainerManager(containerID);
 AuditLog auditLog = kcm.getAuditLogPolicy();

 int percent = 85;
 boolean ret = false;
 try {
     if (auditLog.isAuditLogEnabled()) {
         ret = auditLog.setMaximumLogSize(percent);
     } else {
         Log.w(TAG, "AuditLog is not Running ");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 try {
     AuditLog.w(AuditLog.AUDIT_LOG_GROUP_SECURITY, false, android.os.Process.myPid(), this
             .getClass().getSimpleName(),
             "Pairing bluetooth failed. Unable to get device address.");
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: This API can only be called statically. The context used for log will always be the administrator's one, even if calling this API for container.