Skip to main content
Question

/private/var/log/jamf.log appears in /Applications

  • December 4, 2019
  • 3 replies
  • 31 views
S
Forum|alt.badge.img+15
  • sshort
  • Valued Contributor
  • 301 replies

I recently started at a new org and noticed that a 0 byte Library folder and an orphaned Jamf log are located in /Applications (these are not hidden folders).

If I visit the "real" /private/var/log I do see a Jamf.log file that's up to date. The orphaned log at /Applications/private/var/log/jamf.log only has 2 entries recording a Slack app install that occurred during enrollment.

Has anyone seen similar behavior with typically hidden folders appearing in /Applications with no/orphaned content?

    3 replies

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3567 replies
    • December 5, 2019

    @sshort I'd suggest looking at the installer for Slack that's running at enrollment. It sounds like it's dropping files it shouldn't be (a common occurrence when using Composer's snapshot feature)

    donmontalvo
    Forum|alt.badge.img+36
    • donmontalvo
    • Hall of Fame
    • 4293 replies
    • December 5, 2019

    Curious if this is a Catalina computer, and what version of Composer?

    --https://donmontalvo.com
    S
    Forum|alt.badge.img+15
    • sshort
    • Author
    • Valued Contributor
    • 301 replies
    • December 5, 2019

    @sdagley Ahh, I hadn't thought of that because I usually avoid Composer. @donmontalvo The Mac I observed this behavior on is running 10.14.6, but this problem occurs in Catalina, as well.

    Apparently Slack only provides a dmg installer, and the previous admin set the install policy Target Drive to be /Applications/ instead of the standard /. FUT and FEU were left unchecked, and it seems Jamf was putting the associated log files/receipts from the policy into those orphaned unhidden folders in /Applications.

    I switched the Target Drive back to / and created my own Slack installer pkg, and problem solved.

    Since my original post I found another typically hidden folder (/opt) appearing for all our users, but Jamf wasn't causing that issue. JumpCloud's "binding" script was running mkdir /opt so I had to add chflags hidden to get that to not appear to our users.


    Terms & ConditionsCookie settingsAccessibility statement