Application Usage: The Details

To accomplish application usage logs, the jamfAgent registers to listen for OS X system events specifically pertaining to usage. However, I'm not sure exactly what the jamfAgent is listening to / recording from. It could be something like "ps -ax -o etime,command -c" or simply "top" but...

The types of events the agent receives are: application launching application launched application terminated application activated system sleep system wake system power off screen saver started screen saver stopped screen lock workspace activation workspace deactivation

Listening for these events is not resource intensive at all.

An example scenario of how the data is collected might go something like this:

Firefox is launched (the jamf agent receives the event and makes Firefox the current app to track) User switches to Outlook (the jamf agent receives the event and makes Outlook the current app to track) User uses hot corners to go to screen saver (the jamf agent receives the event and starts tracking screen saver)

After events are received the information is written to a plist file for each user located in this base directory: /Library/Application Support/JAMF/Usage

Reporting usage information: When inventory is submitted on that computer the information from the plists are included in the inventory report. When inventory is about to run, an event is sent to the jamf agents so they will write out the latest usage information to be included in the inventory report.

It would be interesting to know what version of the JSS you are running as there was a defect, D-005591 on version 9.2 where application usage logs were reporting inaccurately, however, this should be resolved.

We have been on 9.22 for about a week. I believe we were on 9.2 before that. Any idea the extent of the inaccurate application usage logs. Like were they all wrong in 9.2? Were any correct? Can we trust any application usage logs from 9.2?

Thanks.

Hard to say with confidence as to the extent as the nature of the defect is inconsistency. The only way (I imagine) one could truly deduce this information is to systematically test and compare with the OS's native monitoring procedures.

What I can tell you (simple test) is that when running a jamf recon -verbose on a client you get "Gathering application usage information..." then it proceeds to "Looking in 2014-02-11" or whatever is the most recent plist in the /Library/Application Support/JAMF/Usage written by the jamfDaemon. When you actually look at the plist that is written, the syntax for the time field is a single digit which would lead me to believe it is being written from "top". The rabbit hole seems to end when you actually investigate the jamfDaemon it has a -monitorUsage string. What that string is calling back to... no idea.

Justin-

Thanks for the info. I can't seem to find any info about this defect in the release notes for 9.2, 9.21, 9.22 or 9.23. Should it be noted in those release notes as a defect/fix?

Ok... more info in regards to the collection.

We are not running queries or pulling from any plists. We are using Objective C code to register the jamfAgent to listen to (for a lack of a better term) events from Apples developer API notification center, so once the agent is registered, the agent can then get the system level event notification information and we then parse that information and write it to the usage plists.

In regards to D-005591, what I can say is that the defect was cancelled, which is why it is not showing in the release notes.

Being diplomatic and with the upmost respect, what I can share is that we are looking into this further in order to verify any inconsistent behavior and make application usage logs as transparent, accurate, and functional as possible.

I have been doing some testing this morning to see how accurate this usage data is and within a couple of hours have already started seeing discrepancies.

For instance, I have done the following:

10 am opened terminal
10:10 am opened fcp
10:25 am opened photoshop
11:05 am switched to fcp
11:27 woke computer up from sleep (fcp is active)
11:39 open text wrangler
(This computer is a laptop that is not plugged into power, so it goes to sleep every 5 minutes)

I had inventory run at 3 points during this process and this is what I saw for just FCP:

1st: 5 minutes usage
2nd: 10 minutes usage
3rd: 5 minutes usage

I'm not sure how the FCP usage time went backwards. This is obviously a serious concern for us. We're seeing flaws within 2 hours of testing. What good is the application usage data if none of it is reliable?

Thanks.
Mark

I hate to say it, but I haven't seen Application Usage be incredibly reliable now for a number of versions. Back in version 7.x when I first started using Casper Suite, it seemed pretty accurate, but somewhere along the line during development of version 8 it started becoming inaccurate. I don't know if it was actually a change in Casper or just the OS X changes that's been causing it though.
Often I see times that add up to considerably more than a 24 hour period in a day, or usage that indicates only one application was open in the foreground through the day, which I know to be incorrect.
Fortunately for us, its more a curiosity than anything we actually need to use for reporting ,so its not much of a concern, but still...

Hi
Is it possible to create a report showing all machines that did run an application e.g. terminal for more than 10 minutes in the last x days?
Any ideas how to do that?
Sorry if it it obvious - I did not find it.
Thanx in advance!

@michaelhusar Not sure if you found an answer for this, but some recent discussions have Application Usage in the forefront at the moment for me. I have an inquiry into Jamf support, but from what I recall, there is no way to get a report of any kind for a group of computers regarding Application Usage. Maybe thats changed in more recent versions, but from what the Admin Guide has about usage backs up my memory about the subject. Let us know what you uncovered as well.

I had to look into this as well and discovered the API https://<your instance goes here>/api/#!/computerapplicationusage/

The key is you have to write come code to get the data out. The API returns 4 fields to you, the App, the version of that app, the number of minutes used during the time period and another field called "open" that we can't identify yet.

You get a giant blob of data that is per computer, and covers a specified time period.