diff --git a/README.md b/README.md
index db0bd5c..03b912a 100644
--- a/README.md
+++ b/README.md
@@ -100,6 +100,29 @@ Finally, you can embed Adam container into an EVE root filesystem creating an EV
      net: host
 ```
 
+### Debug logging
+
+Adam logs every API request it receives. For investigations where you
+also need to see what was *returned* to the device on each `/config`
+poll, set `ADAM_LOG_DEVICE_CONFIG=1` in adam's environment. With this
+on, every served device config produces a one-line summary on stderr:
+
+```
+config served: uuid=<UUID> version=<N> baseos.version=<V> baseos.activate=<bool> \
+    baseos.ct=<content-tree-UUID> baseosconfig_list=<n> contentInfo=<n> apps=<n> \
+    networks=<n> volumes=<n> datastores=<n>
+```
+
+The variable is off by default; turning it on adds one log line per
+`/config` poll per device, which is modest at typical poll intervals
+(~30 s) but multiplies across N devices.
+
+For example, with `docker run`:
+
+```
+docker run -e ADAM_LOG_DEVICE_CONFIG=1 lfedge/adam server
+```
+
 ## Controlling Adam
 
 Adam provides a CLI management interface and Web UI, both of which wrap an open management API.
diff --git a/pkg/server/commonHandler.go b/pkg/server/commonHandler.go
index 97e0973..55bbcce 100644
--- a/pkg/server/commonHandler.go
+++ b/pkg/server/commonHandler.go
@@ -17,6 +17,7 @@ import (
 	"log"
 	"math/rand"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -89,6 +90,28 @@ func configProcess(manager driver.DeviceManager, u uuid.UUID, configRequest *con
 	// also flips ConfigHash and EVE doesn't get 304 Not Modified.
 	msg.ControllercertConfighash = controllerCertConfigHash
 
+	// Optional debug trace of what we're about to serve. Off by
+	// default; set ADAM_LOG_DEVICE_CONFIG=1 to enable when investigating
+	// "what did adam tell EVE on this poll?" questions. Fires before the
+	// 304 Not Modified check so it surfaces the response shape even on
+	// no-change polls.
+	if os.Getenv("ADAM_LOG_DEVICE_CONFIG") == "1" {
+		var bosVer, bosCTUUID string
+		var bosAct bool
+		if msg.Baseos != nil {
+			bosVer = msg.Baseos.BaseOsVersion
+			bosAct = msg.Baseos.Activate
+			bosCTUUID = msg.Baseos.ContentTreeUuid
+		}
+		log.Printf("config served: uuid=%s version=%s baseos.version=%q "+
+			"baseos.activate=%v baseos.ct=%q baseosconfig_list=%d "+
+			"contentInfo=%d apps=%d networks=%d volumes=%d datastores=%d",
+			u, msg.GetId().GetVersion(),
+			bosVer, bosAct, bosCTUUID,
+			len(msg.Base), len(msg.ContentInfo), len(msg.Apps),
+			len(msg.Networks), len(msg.Volumes), len(msg.Datastores))
+	}
+
 	response := &config.ConfigResponse{}
 
 	hash := sha256.New()