# Collect logs from a device

When a developer's tools are misbehaving, you can ask their machine for its logs without
asking them to find a folder.

## Requesting

**Diagnostics → the device row → Request logs.** The button becomes "Logs requested" with
a ten-minute cooldown, and the section header counts outstanding requests.

The Endpoint Suite polls roughly every two minutes, so a running machine responds within a
few minutes. A machine that is off responds when it comes back.

## What arrives

A bundle in the **Log bundles** table: which user and device, its size, when it was
uploaded, and its expiry. Bundles are kept for **14 days** and the badge shows the
remaining time.

**Download** fetches it.

## What is in it

**Event logs only — never prompt content and never secrets.** Which tools were detected,
what was governed, connection attempts and their errors, update checks, sync activity.

That constraint is what makes this feature safe to use routinely: you can ask any developer
for logs without asking them to trust you with what they were working on.

## Sharing with support

**Share with support** attaches a bundle to your organization's support access so we can
look at it. This is explicit and per-bundle — support cannot reach into your log bundles
otherwise. The row then shows "Shared with support".

Attaching the bundle to a support ticket as well gives us the context to go with it.