Posted on 01-28-2021 04:31 PM
Hi Jamf Nation,
I'm working on a script to capture the most recent causes of a restart. This command works great on Intel Macs and provides useful data output:
log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h
Does anybody know of the equivalent log predicate for Macs with Apple Silicon? In all of my testing on my lab M1 this command does not respond back with useful data, and I can't find the proper log predicate to give me what I need.
For context, this blog article brilliantly shows the response codes and probable causes for the restarts.
Posted on 02-08-2021 02:57 AM
While i cant help with M1 mac's how are you viewing this info in the JSS?
I want to be able to set this as an attribute extension if possible but even if i grep the data i want i still get nothing after an inventory with my one liner
log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 7d | grep "Previous shutdown cause:"
Posted on 02-08-2021 04:27 AM
Maybe it is interesting to look at the following to gather your specific logs into Jamf Pro for in the Computer record.
Posted on 02-09-2021 03:47 AM
Wow, i had no idea that this existed. Thanks so much. Looks like it will need some work for what the client wants but at least i can now get the logs from the machines now