When troubleshooting complex endpoint issues, network blocks, or unexpected policy behavior, the HEIMDAL Support Team may require detailed diagnostic logs to identify the root cause. This article guides administrators and end-users through the step-by-step process of collecting these logs using two different methods: remotely from the Heimdal Dashboard (best for administrators who need to gather logs silently from one or multiple corporate devices without disrupting the end-user) and locally (best for immediate, individual machine troubleshooting directly from the endpoint's user interface or local directories).
1. Fetching the HEIMDAL Agent logs (in the HEIMDAL Dashboard)
2. Fetching the HEIMDAL Agent logs (on Windows)
3. Fetching the HEIMDAL Agent logs (on macOS)
4. Fetching the HEIMDAL Agent logs (on Ubuntu/Debian)
Fetching the HEIMDAL Agent (in the HEIMDAL Dashboard)
Administrators can remotely request diagnostic logs from any online endpoint. The Heimdal Agent will compress and upload the logs silently on its next Group Policy synchronization check.
1. Open your browser, log into the HEIMDAL Dashboard, and use the left-hand sidebar menu to navigate to Unified Management -> Device Info.
2. From the list of active devices under the Standard or Hardware tab, locate the specific machine requiring troubleshooting and click on its hostname to open its detailed endpoint view.
3. Once inside the device's specific overview page, locate the row of module sub-tabs running across the top. You can request the Heimdal logs by pressing the Request Logs button.
This action will prompt a modal that allows you to choose what type of logs to fetch.5. Another method to collect the logs and also inspect past requests is to click on the Logs tab -> Heimdal Endpoint Logs. In the Logs tab, you can also request the Windows Event Viewer logs or other logs.
6. Click the Request Heimdal Endpoint Logs button.
7. The command will be queued and executed on the device's next check-in interval. Once uploaded, a download link for the compressed archive will appear directly in this grid.
Fetching the HEIMDAL Agent logs (on Windows)
1. Click on This PC and then go to Local Disk (C:).
2. Go to the top of the window and click on View and make sure you have Hidden Items checked, then go to the folder C:\ProgramData\Heimdal Security 3. Press the CTRL button and select Heimdal Logs and Logs folders. Then right-click and go to Send to > Compressed (zipped) folder.
4. Send us the .zip archive.
Fetching the HEIMDAL Agent logs (on macOS)
1. Open the Terminal, and run the following command line:
curl https://heimdalqastorage.blob.core.windows.net/mac-agent-tools/log_zipper.sh --output log_zipper.sh && sudo sh ./log_zipper.sh
2. The script (requires sudo permissions) will collect all Heimdal Logs, archive them and place the archive on the Desktop:
3. Send us the archives.
Fetching the HEIMDAL Agent log (on Ubuntu/Debian)
1. Open the Files Explorer and navigate to Other Locations -> usr -> sbin - heimdal
2. Copy them to your computer where you can archive them.
3. Send us the archive.
Log Retention and Rotation
The Heimdal Agent performs automatic log rotation as part of its normal operation. Because the Heimdal Agent is designed to generate logs every day (02.06.2026.log), the automatic log rotation kicks in when the number of files inside one of the Heimdal logs folders (e.g., Heimdal.AdminPrivilege, Heimdal.ClientHost, etc.) exceeds 31 files. When writing the file corresponding to the new day, it looks at all files and removes the files that are older than the last 31 log files. This is how the Heimdal Agent retains the latest log files that should correspond to the last 31 days (when the endpoint was active). This process is managed internally by the Agent and does not require manual configuration or intervention.
If logs are required for troubleshooting or auditing purposes beyond this retention period, they should be collected and stored externally before rotation occurs.