Skip to main content
Question

Extension Attribute to search logs

  • April 2, 2024
  • 3 replies
  • 13 views

Forum|alt.badge.img+4

Hello All

Im trying to create an Extension Attribute that searches the JAMF log in /private/var/log for a particular word (an error code) and if its there to report a positive or negative.  Any idea of the scripting for this?  

3 replies

sdagley
Forum|alt.badge.img+25
  • Jamf Heroes
  • April 2, 2024

Something like this should work as an EA returning an Integer with 0 meaning not found and 1 meaning found:

#!/bin/sh result="0" ErrorCodeFound=$(grep -w 'ErrorWord' "/private/var/log/name_of_log_file") if [ -n "$ErrorCodeFound" ]; then result="1" fi echo "<result>$result</result>"

Forum|alt.badge.img+4
  • Author
  • Contributor
  • April 2, 2024

Thanks!  So would this work if Im looking for the existence of "Error:-14167" in a log?

#!/bin/sh result="0" ErrorCodeFound=$(grep -w 'Error:-14167' "/private/var/log/jamf.log") if [ -n "$ErrorCodeFound" ]; then result="1" fi echo "<result>$result</result>"

sdagley
Forum|alt.badge.img+25
  • Jamf Heroes
  • April 2, 2024

Thanks!  So would this work if Im looking for the existence of "Error:-14167" in a log?

#!/bin/sh result="0" ErrorCodeFound=$(grep -w 'Error:-14167' "/private/var/log/jamf.log") if [ -n "$ErrorCodeFound" ]; then result="1" fi echo "<result>$result</result>"

Yep, the EA as you modified it will return 1 if "Error:-14167" is anywhere in the jamf.log file. Note that means once you've hit the error that EA will find it until the log file rolls over.