ChromeOS Shell Commands (crosh)

You are here:
< Back

autest [-scheduled]

Trigger an auto-update. To fake a scheduled update check use -scheduled.

authpolicy_debug <level>

Set authpolicy daemon debugging level.
<level> can be 0 (quiet), 1 (taciturn), 2 (chatty), or 3 (verbose).

battery_firmware <info|check|update>

info : Query battery info.
check : Check whether the AC adapter is connected.
Also check whether the battery firmware is the latest.
update : Trigger battery firmware update.

battery_test [<test length>]

Tests battery discharge rate for given number of seconds. Without an argument,
defaults to 300 seconds.

bt_console [<agent capability>]

Enters a Bluetooth debugging console. Optional argument specifies the
capability of a pairing agent the console will provide; see the Bluetooth
Core specification for valid options.

c <container name> [args]

Run a program inside a container


When prompted, set or clear CCD password (use the word ‘clear’ to clear
the password).

chaps_debug [start|stop|<log_level>]

Sets the chapsd logging level. No arguments will start verbose logging.


Shows connectivity status. “connectivity help” for more details


Get human-readable status information from cryptohomed.

dmesg [-d|-k|-r|-t|-u|-w|-x]

Display kernel log buffer


Show the EMK (Enterprise Machine Key).

enroll_status [–mode] [–domain] [–realm] [–user]

Displays device enrollment information.

evtest evtest

Run evtest in safe mode.


Exit crosh.


Usage: ff_debug [<tag_expression>]|[–reset]|[–help]|[–list_valid_tags]|[–level <level>]

ff_debug adds and removes debug tags for flimflam.
Current debug settings are displayed if no parameters are provided

<tag_expression> is defined in boolean notation using <debug_tag> separated
by an operator [+-], where + and – imply adding and removing of the tag immediately
following the operator. An expression beginning with either operators [+-]
takes the existing tags and modifies them appropriately. Otherwise, the existing tags
are replaced by those specified in the command.

<debug_tag> can be listed using the –list_valid_tags

e.g.: ff_debug network+wifi
Sets debug tags to network and wifi
e.g.: ff_debug +network-service
Adds network and removes service tags from the existing debug settings

–list_valid_tags : Displays all valid tags

–level: Displays or sets current debug level for logging
All messages at, or above, the current log level are logged. Normal log
levels range from 4 (LOG_FATAL) to 0 (LOG_INFO). In addition VERBOSE log
levels are available starting at -1.

e.g.: ff_debug –level 4
Logs only FATAL messages.
e.g.: ff_debug –level 0
e.g.: ff_debug –level -4
Logs everything that –level 0 does, plus SLOG(<tag>, <n>) messages,
where <tag> has been enabled for logging, and <n> <= 4. (NOTE: you must
negate SLOG levels for use with ff_debug. In this example, SLOG(<tag>, 4)
maps to –level -4.)

–reset : Removes all tagging

–help : Displays this output

free [options]

Display free/used memory info

help [command]

Display general help, or details for a specific command, similar to man on GNU-Linux machines.


Display the help for more advanced commands, mainly used for debugging.


Display detailed memory statistics


Performs extensive memory testing on the available free memory.

modem <command> [args…]

Interact with the 3G modem. Run “modem help” for detailed help.

modem_set_carrier carrier-name

Configures the modem for the specified carrier.


Usage: /usr/bin/network_diag [–date|–flimflam|–link|–show-macs|–wifi|–help|
–wifi-mon] [host]
–date: Diagnose time-of-day
([host] must support SSL)
–dhcp: Display DHCP information
–flimflam: Diagnose flimflam status
–hosts: Diagnose SSL connection to Google hosts
–interface: Diagnose interface status
–latency: Diagnose link-latency to default gateway
–link: Diagnose all network links
–no-log: Do not log output
–proxy: Specify proxy to use with tests
–route: Diagnose routes to each host
–show-macs: Display full MAC addresses
–wifi: Display driver-specific debugging information
–wifi-mon: Monitor WiFi performance metrics
–help: Display this message
[host] Hostname to perform web access test on (default:

p2p_update [enable|disable] [–num-connections] [–show-peers]

Enables or disables the peer-to-peer (P2P) sharing of updates over the local
network. This will both attempt to get updates from other peers in the
network and share the downloaded updates with them. Run this command without
arguments to see the current state. Additional switches will display number
of connections and P2P peers.

ping [-4] [-6] [-c count] [-i interval] [-n] [-s packetsize] [-W waittime] <destination>

Send ICMP ECHO_REQUEST packets to a network host. If <destination> is “gw”
then the next hop gateway for the default route is used.
Default is to use IPv4 [-4] rather than IPv6 [-6] addresses.

rlz < status | enable | disable >

Enable or disable RLZ. See this site for details:


Attempt to rollback to the previous update cached on your system. Only
available on non-stable channels and non-enterprise enrolled devices. Please
note that this will powerwash your device.

route [-4] [-6]

Display the routing tables.
Default is to show IPv4 [-4] rather than IPv6 [-6] routes.

set_apn [-c] [-n <network-id>] [-u <username>] [-p <password>] <apn>

Set the APN to use when connecting to the network specified by <network-id>.
If <network-id> is not specified, use the network-id of the currently
registered network.

The -c option clears the APN to be used, so that the default APN will be used

set_arpgw <true | false>

Turn on extra network state checking to make sure the default gateway
is reachable.

set_cellular_ppp [-c] [-u <username>] [-p <password>]

Set the PPP username and/or password for an existing cellular connection.
If neither -u nor -p is provided, show the existing PPP username for
the cellular connection.

The -c option clears any existing PPP username and PPP password for an
existing cellular connection.

set_time [<time string>]

Sets the system time if the the system has been unable to get it from the
network. The <time string> uses the format of the GNU coreutils date command.

set_wake_on_lan <true | false>

Enable or disable Wake on LAN for Ethernet devices. This command takes
effect after re-connecting to Ethernet and is not persistent across system


Breaks out of the crosh shell and launches a bash shell on devices with developer mode active.


Performs a short offline SMART test.


Performs an extensive readability test.

swap [ enable <size (MB)> | disable | start | stop | status | set_margin <discard threshold (MB)> | set_extra_free <amount (MB)> | set_min_filelist <amount (MB)> ]

Change kernel memory manager parameters

“swap status” (also “swap” with no arguments) shows the values of various
memory manager parameters and related statistics.

The enable/disable options enable or disable compressed swap (zram)
persistently across reboots, and take effect at the next boot. The enable
option takes the size of the swap area (in megabytes before compression).
If the size is omitted, the factory default is chosen.

The start/stop options turn swap on/off immediately, but leave the settings
alone, so that the original behavior is restored at the next boot.

WARNING: if swap is in use, turning it off can cause the system to
temporarily hang while the kernel frees up memory. This can take
a long time to finish.

The set_margin, set_min_filelist, and set_extra_free options change
kernel parameters with similar names. The change is immediate and
persistent across reboots. Using the string “default” as the value
restores the factory default behavior.

syslog <message>

Logs a message to syslog (the system log daemon).


Returns the current synchronization state for the time service.


Runs the GNU top application.


Prints TPM (Trusted Platform Module) status information.

tracepath [-4] [-6] [-n] <destination>[/port]

Trace the path/route to a network host.
Default is to trace IPv4 [-4] rather than IPv6 [-6] targets.

u2f_flags <u2f | g2f>[,verbose]

Set flags to override the second-factor authentication daemon configuration.
u2f: Always enable the standard U2F mode even if not set in device policy.
g2f: Always enable the U2F mode plus some additional extensions.
verbose: Increase the daemon logging verbosity in /var/log/messages.

uname [-a|-s|-n|-r|-v|-m|-p|-i|-o]

Display system info

update_over_cellular [enable|disable]

Enables or disables the auto updates over cellular networks. Run without
arguments to see the current state.


Uploads available crash reports to the crash server.

upload_devcoredumps [enable|disable]

Enable or disable the upload of devcoredump reports.


Display uptime/load info


Verify AP and EC RO firmware on a Chrome OS device connected over SuzyQ
cable, if supported by the device.

vmc [ start <name> | stop <name> | destroy <name> | list ]

Start or stop a VM.

vmstat [-a|-d|-f|-m|-n|-s|-w] [delay [count]]

Report virtual memory statistics

vsh <name>

Connect to a shell inside the VM <name>.

wifi_power_save < status | enable | disable >

Enable or disable WiFi power save mode. This command is not persistent across
system restarts.


Usage: wpa_debug [level]|[–reset]|[–help][–list_valid_levels]

wpa_debug sets the debug level of wpa_supplicant.
Current debug level is displayed if no parameters are provided

level: The level is the level we want to set the debugging level to. The valid
levels can be viewed by using the –list_valid_levels flag

eg: wpa_debug msgdump
Sets the wpa_supplicant logging level to msgdump

–reset : Resets the level to ‘info’

–help : Displays this output

–list_valid_levels: Displays the valid levels wpa_supplicant can be set to