capturing the Install Date of apps?

[ChrisJScott-wor]

Has anybody ever figured out how to do this? I've got a script that captures "Last Opened" but I have never been able to crack the "App installed on" nut and it would be very useful when constructing Application Usage reports....

[talkingmoose]

This only works for Apple installer packages since nothing logs when a drag-and-drop app was copied to the Mac. Keep in mind this is only the original install date not the last time the app was updated.

https://gist.github.com/0cefc38d6b835167f5db95231e0050e9

[psliequ]

This will show all App Store and .pkg based installs and updates starting from the day the system was set up to the current date.
You should be able to slice it up however you need.

softwareupdate --history --all | sed '/----/d; /Display/d' | grep -v softwareupdated

[jkryklywec]

can you post the script for last opened please, thanks

[donmontalvo]

@jkryklywec here's what we use:

$ mdls /Applications/Packages.app -name kMDItemLastUsedDate | awk '/2020/{print $3}'
2020-04-08

[tlarkin]

Spotlight can do this, but mind you it changes anytime an update is applied. So for example, if you have a Mac that has been actively deployed for two years, it won't show that the original time on disk was 2 years ago, it will go off the last modification.

% mdls -raw -name "kMDItemDateAdded" /Applications/Firefox.app
2020-04-10 18:31:50 +0000

Using the -raw switch it will just return the value of the key you are querying for so no need to awk or sed or grep

[donmontalvo]

@tlarkin nice, thanks! Curious how your output didn't include your prompt? Tried both bash and zsh:

$ mdls -raw -name kMDItemDateAdded /Applications/Firefox.app
2020-04-13 04:36:18 +0000$

% mdls -raw -name kMDItemDateAdded /Applications/Firefox.app 
2020-04-13 04:36:18 +0000%

Works fine in an EA:

#!/bin/bash
APP_PATH="/Applications/Firefox.app"
if [ -e "$APP_PATH" ]
then
    echo "<result>$(mdls -raw -name kMDItemDateAdded "$APP_PATH")</result>"
else
    echo "<result>DoesNotExist</result>"
fi

Which outputs:

$ /tmp/test.sh
<result>2020-04-09 16:10:20 +0000</result>
$

[tlarkin]

@donmontalvo You mean the trailing % ? It was there I just did not copy/paste it. When you capture that into a variable in the shell though, it should not include that. My guess that prompt is at the end due to how the developer prints to stdout in the shell, but like you just tested works fine in a script

[JustinNichols]

Hi Everyone,

We actually had a request by an internal team to get the install dates from JAMF. I was surprised this didn't come standard in JAMF itself, but with what most of you were doing here, I created a script that will output all the applications and their installed date into the attributes. Hope this helps others as it took a few days to get it worked out.

#!/bin/bash

#Created by Justin
#This will do a loop through all the applications located in the users mac#
if [ -d /Applications ]; then
    RESULT=$(for i in $(find /Applications/ -maxdepth 1 -name "*.app" | sed 's/Applications//' | sed 's/[/]//g' | sed "s/ /*/g") ; do mdls /Applications/$i -name "kMDItemFSName" -raw -name "kMDItemDateAdded" | xargs -0 | awk '{print $1,$4$5$6$7$8$9$10}' ; done)
else
    RESULT="Applications folder not found."
fi
echo "<result>$RESULT</result>"