diff --git a/compos/common/compos_client.rs b/compos/common/compos_client.rs
index 072b90b..d738e39 100644
--- a/compos/common/compos_client.rs
+++ b/compos/common/compos_client.rs
@@ -103,7 +103,13 @@
         let manifest_apk_fd = ParcelFileDescriptor::new(manifest_apk_fd);
         let idsig_manifest_apk_fd = prepare_idsig(service, &manifest_apk_fd, idsig_manifest_apk)?;
 
-        let (console_fd, log_fd, debug_level) = if parameters.debug_mode {
+        let debug_level = match (protected_vm, parameters.debug_mode) {
+            (_, true) => DebugLevel::FULL,
+            (false, false) => DebugLevel::APP_ONLY,
+            (true, false) => DebugLevel::NONE,
+        };
+
+        let (console_fd, log_fd) = if debug_level != DebugLevel::NONE {
             // Console output and the system log output from the VM are redirected to file.
             let console_fd = File::create(data_dir.join("vm_console.log"))
                 .context("Failed to create console log file")?;
@@ -112,9 +118,9 @@
             let console_fd = ParcelFileDescriptor::new(console_fd);
             let log_fd = ParcelFileDescriptor::new(log_fd);
             info!("Running in debug mode");
-            (Some(console_fd), Some(log_fd), DebugLevel::FULL)
+            (Some(console_fd), Some(log_fd))
         } else {
-            (None, None, DebugLevel::NONE)
+            (None, None)
         };
 
         let config_path = parameters.config_path.as_deref().unwrap_or(DEFAULT_VM_CONFIG_PATH);