ABRLog: a Multi-Device Android Bugreport Log Dataset for Intelligent Analysis

ABRLog (Android BugReport Log) is a multi-device log dataset built from Androidbugreport captures. A bugreport is the diagnostic bundle Android produces ondemand, concatenating kernel, framework, power, memory and application logs intoa single text file of typically 50-500 MB; ABRLog decomposes 45 such capturesinto per-subsystem log blocks, so that each log type can be studied on its ownwhile remaining linked to the device and the capture it came from. The capturesspan 15 distinct handsets from five manufacturers (Samsung, Motorola, Google,Xiaomi and Huawei) and six Android versions (9 through 14, API levels 28-34). Extraction applies two complementary approaches to the same input: line-by-lineregular-expression matching for eight block types whose entries follow a fixedline format (logcat, dmesg, batterystats, wakelock, system_properties, cpuinfo,memory and battery_capacity), and delimiter-based section parsing for seventeenblock types that Android emits between "------ SECTION ------" headers. Both runin a single streaming pass per capture. The result is 1,012 structured filesacross 24 block types, holding 9,971,165 lines and 1.14 GiB, extracted from6.34 GiB of raw captures - an 82.0% reduction that discards the boilerplatewhile keeping every log line. The Drain parser was then applied to the sevenlargest block types, producing 212,071 event templates from 8,596,594 lines,released as 620 CSV files that pair each parsed line with the template itmatched. Personal data was removed before publication. A scripted screening pass over theraw captures, followed by pseudonymization with HMAC-SHA256 under a random key,replaced 287,264 occurrences of 15,525 distinct identifiers: 9,528 e-mailaccounts (including WhatsApp identifiers, whose local part is a telephonenumber), 4,336 MAC addresses, 1,194 Wi-Fi network names, 307 notification texts,74 account records, 62 telephone numbers, 11 IMEI/IMSI values, 8 GPS coordinatesand 5 ICCID/MSISDN values. Replacement is deterministic and shape-preserving -digit counts, quoting and the user@domain form survive, and a given account mapsto the same pseudonym in every file and on every device - so log structure andcross-capture correlation are retained while the identities behind them cannotbe recovered from the release. Analyses that depend on the literal values ofthese fields are correspondingly out of scope. The deposit ships five archives: the raw captures (ABRLog_RawData.zip), theextracted blocks (ABRLog_Dataset.zip), the Drain output (ABRLog_ParsedLogs.zip),the complete extraction, analysis and pseudonymization pipeline(ABRLog_Scripts.zip), and the aggregated values behind every table and figure ofthe accompanying data article (ABRLog_SummaryData.zip), which lets any reportednumber be verified without downloading the multi-gigabyte trees. All sizes usebinary units (1 GiB = 1024 MiB). Because the logs carry no hand-annotated groundtruth, ABRLog is a substrate for log parsing, anomaly detection, cross-device andcross-version comparison and mobile diagnostics research rather than an accuracybenchmark, and every quantity reported here is directly measurable in thereleased files.