Logs for Computer Deletion from Jamf

Question

Hi Everybody!

Just throwing this one out there in hopes that someone has been in this situation before.

This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!!

Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent.

I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so".

Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS.

Thanks in advance!

claven · Accepted Answer

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

PatrickD · Answer

Many thanks @claven ,So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.logI found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.

Sign up

Login with SSO

Login to the community

Login with SSO