This Android 17 setting logs suspicious activity on your phone for troubleshooting - turn it on ASAP

Jack Wallen/ZDNET

Follow ZDNET: Add us as a preferred source on Google.

ZDNET's key takeaways

• Android now allows you to store and view security logs.
• Intrusion Logging can help you track down security issues.
• The feature is free and available on Android 17.

As a longtime Linux user, I am accustomed to having access to all the logs I need. With those logs, I can track down any issues that arise and troubleshoot them. I can also look into suspicious behavior, such as an app or service sending or receiving information that it shouldn't.

On Linux, there are logs for just about anything.

Also: Your Android phone's most powerful security feature is off by default - turn it on ASAP

Until a recent Android 17 security update, logs have been pretty much MIA. But now, with Intrusion Logging, that's changed.

What is Intrusion Logging?

Intrusion Logging provides a log of security events on your Android phone, derived from the Android SecurityLog API. Once the feature is enabled, it starts tracking events on your phone. These logs use end-to-end encryption, and even though they are stored on Google Cloud servers, the only person who can view them is you because the decryption key is linked to your account password and screen lock.

Also: I enabled Android's new security feature that detects fake cell towers - here's why

The information stored in the Intrusion Logging logs relates to application activity; installation, deletion, and updating of apps; network connections, including DNS queries, IP addresses, and Wi-Fi and Bluetooth status; file transfers via Bluetooth; modifications to system certificates; and phone locking and unlocking events.

Having access to those logs could be key to solving security-related issues on your device, and now you have access to a log that hands over such information.

How to enable Intrusion Logging

Enabling Intrusion Logging is quite simple. All you have to do is go to Settings > "Security & privacy" > Advanced Protection. Scroll to the bottom of that page and tap Intrusion Logging.

Advanced Protection offers plenty of security features for you to consider.

Jack Wallen/ZDNET

On the resulting page, tap the on/off slider until it's in the on position. Also, make sure the feature is associated with the correct Google account.

Just tap the slider and you'll be prompted to prove you are who you say you are.

Jack Wallen/ZDNET

Also: Google is training AI on even more of your data now, unless you opt out - here's how

With Intrusion Logging enabled, that's all you need to do unless you suspect something has happened.

How to view the log

Scroll to the bottom of the same page on which you enabled the logs and tap "Access logs." Scroll to the bottom of the new page and tap "Download & decrypt." You will then be prompted to verify your identity via biometric authentication, a PIN, or a password.

You'll have to once again prove you are you.

Jack Wallen/ZDNET

Once you tap "Download & decrypt," wait for the log to download. You'll see a notification in your notification shade when the download is complete. Tap that notification to view the log. When prompted, tap Open, and then select the app to use for viewing. If you use the Files app, you'll see a folder labeled Intrusion Logging. Inside that folder is a zip file. Tap the zip file, and then select which app to use to open it, such as Archive Viewer.

Also: Android backups count toward your 15GB Google storage limit now - check your settings

Inside the zip file will be several .txt files that contain the logs for you to view.

Instead of viewing the logs on your phone, you would be better off sending the zip file to your computer and viewing them there. Log files, even those generated by and for your Android phone, can be pretty cumbersome to view on a small display. On top of that, you can use a desktop text editor to search for specific strings, such as "security_event."

Hopefully, you'll never have to use Intrusion Logging, but if you do, you'll be glad that it's there. I recommend enabling that feature immediately so you have access to your phone's logs should something suspicious happen.