TAO logs and support bundles
Where TAO writes logs on Windows and Linux, how to read them, and how to create a redacted support bundle for analysis.
TAO logs and support bundles
Use this article when you need to inspect agent health locally or prepare a diagnostic package for Trustity Support. Prefer the support-bundle command over manually copying enrollment secrets or camera evidence.
Quick collect (preferred)
On an elevated shell (Administrator on Windows, root/sudo on Linux):
Windows
cd /d "C:\Program Files\Trustity\TAO"
tao-agent.exe support
Linux
sudo tao-agent support
The command prints the path of a .tar.gz under the system temp directory. Optional flags:
| Flag | Purpose |
|---|---|
--output PATH | Write the archive to a chosen path |
--lines N | Linux only: journal lines to include (default 500) |
Example:
sudo tao-agent support --output /tmp/tao-hostA.tar.gz --lines 1000
What is included
- Agent version, hostname, OS, data-dir path, and non-secret
TAO_*environment - Enrollment / policy summary (
status.txt) — not the agent secret - Service health (
sc queryon Windows;systemctl+journalctlon Linux) - Redacted copy of the data directory (config, policy cache, module state)
- Windows file logs when present (
service.log,tao-lock.log, Setup install log)
What is excluded
agent.secretand other*.secret/*.keyfiles- VisionX evidence images (JPEG/PNG/etc.)
- Organization license keys
- Individual state files larger than 8 MiB (noted as skipped)
Review the archive inside your organization before sharing. Do not paste license keys or vaulted passwords into tickets.
Where logs live
Windows
| Artifact | Location |
|---|---|
| Data directory (enrollment, policy cache, module state) | %ProgramData%\Trustity\TAO\ |
| Service log | %ProgramData%\Trustity\TAO\service.log |
| Lock UI log | %ProgramData%\Trustity\TAO\tao-lock.log |
| Setup / install trace | %TEMP%\TrustityAgentSetup.log |
| Windows service name | TrustityAgent |
Useful checks:
sc query TrustityAgent
type "%ProgramData%\Trustity\TAO\service.log"
tao-agent.exe status
Linux
TAO does not write a dedicated file under /var/log. The systemd unit sends stdout/stderr to the journal.
| Artifact | Location |
|---|---|
| Data directory | /var/lib/trustity/tao (override with TAO_DATA_DIR) |
| Binary | /usr/local/bin/tao-agent |
| Unit | trustity-tao.service (/etc/systemd/system/trustity-tao.service) |
| Runtime logs | journalctl -u trustity-tao |
| On-prem portal CA (if used) | /var/lib/trustity/portal-ca.crt |
Useful checks:
sudo tao-agent status
sudo systemctl status trustity-tao
sudo journalctl -u trustity-tao -n 100 --no-pager
sudo journalctl -u trustity-tao -f
Raise verbosity temporarily by setting TAO_LOG=debug on the unit (or shell) and restarting the service, then restore info after capture.
Escalation
Attach the support bundle path contents (after review) together with:
- Organization name (not the license key)
- Hostname, OS, agent version
- Symptom and first observed time with timezone
- Steps already tried from Troubleshoot an offline or stale agent