Skip to main content
Solved

Logs for Computer Deletion from Jamf

  • April 10, 2017
  • 3 replies
  • 138 views
PatrickD
Forum|alt.badge.img+9

Hi Everybody!

Just throwing this one out there in hopes that someone has been in this situation before.

This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!!

Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent.

I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so".

Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS.

Thanks in advance!

Best answer by claven

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

3 replies

C
Forum|alt.badge.img+11
  • claven
  • New Contributor
  • Answer
  • April 10, 2017

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

PatrickD
Forum|alt.badge.img+9
  • PatrickD
  • Author
  • Valued Contributor
  • April 10, 2017

Many thanks @claven ,

So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.log

I found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.

R
E
Forum|alt.badge.img+5
  • eaititig
  • Contributor
  • May 30, 2025

I wonder where these logs are in cloud instances of JAMF?  They're not in the server logs.

R
Terms & ConditionsCookie settingsAccessibility statement