Skip to main content
Question

Is it possible to grab a log file on a macOS system and upload it somewhere else through jamf?


Forum|alt.badge.img+2

We have a 'Make Yourself an Admin for 10 Min" self service that stores logs for those 10 min. Issue is I am not sure how to grab them or get them somewhere where we can do spot checks. Is this possible?

5 replies

DBrowning
Forum|alt.badge.img+24
  • Esteemed Contributor
  • 668 replies
  • December 7, 2022

Using the API, you can upload a log to the computer record in Jamf.  Take a look at the filesupload in the API.

You can POST different types of files by entering parameters for {resource}, {idType}, and {id}, for example /JSSResource/fileuploads/computers/id/2. Attachments can be uploaded by specifying computers, mobiledevices, enrollmentprofiles, printers, or peripherals as the resource. Icons can be uploaded by specifying policies, ebooks, or mobiledeviceapplicationsicon as the resource. A mobile device application can be uploaded by using mobiledeviceapplicationsipa. A disk encryption can be uploaded by specifying diskencryptionconfigurations as the resource. idTypes supported are id and name, although peripheral names are not supported. A sample command is curl -k -u user:password https://my.JamfPro:8443/JSSResource/fileuploads/computers/id/2 -F name=@/Users/admin/Documents/Sample.doc -X POST


Forum|alt.badge.img+19
  • Honored Contributor
  • 582 replies
  • December 7, 2022

Take a look at this script in Jamf's Github repository:

https://raw.githubusercontent.com/kc9wwh/logCollection/master/logCollection.sh

You can create a script with a script argument that points to log file(s) you want to collect and it will upload them to the Jamf attachments for that computer. 

Just adding the obligatory note, putting user credentials in a script that runs on local computers is bad security practice. Consider your options and, if you choose to do this, use a API users with the absolute minimum permissions required. 


Forum|alt.badge.img+2
  • Author
  • New Contributor
  • 1 reply
  • December 7, 2022
Tribruin wrote:

Take a look at this script in Jamf's Github repository:

https://raw.githubusercontent.com/kc9wwh/logCollection/master/logCollection.sh

You can create a script with a script argument that points to log file(s) you want to collect and it will upload them to the Jamf attachments for that computer. 

Just adding the obligatory note, putting user credentials in a script that runs on local computers is bad security practice. Consider your options and, if you choose to do this, use a API users with the absolute minimum permissions required. 


Problem I had with this is the log files always come into attachments blank theres nothing in them but if I view them on the local machine there is thousands of lines of logs


AJPinto
Forum|alt.badge.img+26
  • Legendary Contributor
  • 2767 replies
  • December 8, 2022

Depends on what exactly you are wanting to do and why. 

 

If it was me. I would add a function to the privilege demotion script (make me an admin no more) to mount a SMB share hidden using a service account, and copy the log file over to that share and unmount the share. If SMB is not an option you could use CLI with CURL or JAMF API to do the thing. You would need a naming convention for the log file so you could find what you want, but this would escrow logs in a save nonlocal location. Identity and Privilege management is outside of the work flow for MDM, you will find better tools equipped for IDM and Access Logging than JAMF Pro.


jamf-42
Forum|alt.badge.img+17
  • Esteemed Contributor
  • 744 replies
  • December 8, 2022

grep the log in the policy via files and processes?  this will grab the logs for today.. note you'll need to fix the date to your date log.. this is YYYY-MM-DD, you'll get the output in the policy log.. 

 

grep "`date +"%Y-%m-%d"`" /PATH TO YOUR LOG

 


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings