capturing the Install Date of apps?

ChrisJScott-wor
New Contributor III

Has anybody ever figured out how to do this? I've got a script that captures "Last Opened" but I have never been able to crack the "App installed on" nut and it would be very useful when constructing Application Usage reports....

8 REPLIES 8

talkingmoose
Honored Contributor II
Honored Contributor II

This only works for Apple installer packages since nothing logs when a drag-and-drop app was copied to the Mac. Keep in mind this is only the original install date not the last time the app was updated.

https://gist.github.com/0cefc38d6b835167f5db95231e0050e9

psliequ
Contributor III
Contributor III

This will show all App Store and .pkg based installs and updates starting from the day the system was set up to the current date.
You should be able to slice it up however you need.

softwareupdate --history --all | sed '/----/d; /Display/d' | grep -v softwareupdated

jkryklywec
New Contributor III

can you post the script for last opened please, thanks

donmontalvo
Esteemed Contributor II

@jkryklywec here's what we use:

$ mdls /Applications/Packages.app -name kMDItemLastUsedDate | awk '/2020/{print $3}'
2020-04-08
--
https://donmontalvo.com

tlarkin
Honored Contributor

Spotlight can do this, but mind you it changes anytime an update is applied. So for example, if you have a Mac that has been actively deployed for two years, it won't show that the original time on disk was 2 years ago, it will go off the last modification.

% mdls -raw -name "kMDItemDateAdded" /Applications/Firefox.app
2020-04-10 18:31:50 +0000

Using the -raw switch it will just return the value of the key you are querying for so no need to awk or sed or grep

donmontalvo
Esteemed Contributor II

@tlarkin nice, thanks! Curious how your output didn't include your prompt? Tried both bash and zsh:

$ mdls -raw -name kMDItemDateAdded /Applications/Firefox.app
2020-04-13 04:36:18 +0000$
% mdls -raw -name kMDItemDateAdded /Applications/Firefox.app 
2020-04-13 04:36:18 +0000%

Works fine in an EA:

#!/bin/bash
APP_PATH="/Applications/Firefox.app"
if [ -e "$APP_PATH" ]
then
    echo "<result>$(mdls -raw -name kMDItemDateAdded "$APP_PATH")</result>"
else
    echo "<result>DoesNotExist</result>"
fi

Which outputs:

$ /tmp/test.sh
<result>2020-04-09 16:10:20 +0000</result>
$
--
https://donmontalvo.com

tlarkin
Honored Contributor

@donmontalvo You mean the trailing % ? It was there I just did not copy/paste it. When you capture that into a variable in the shell though, it should not include that. My guess that prompt is at the end due to how the developer prints to stdout in the shell, but like you just tested works fine in a script

JustinNichols
New Contributor

Hi Everyone,

We actually had a request by an internal team to get the install dates from JAMF. I was surprised this didn't come standard in JAMF itself, but with what most of you were doing here, I created a script that will output all the applications and their installed date into the attributes. Hope this helps others as it took a few days to get it worked out.

#!/bin/bash

#Created by Justin
#This will do a loop through all the applications located in the users mac#
if [ -d /Applications ]; then
    RESULT=$(for i in $(find /Applications/ -maxdepth 1 -name "*.app" | sed 's/Applications//' | sed 's/[/]//g' | sed "s/ /*/g") ; do mdls /Applications/$i -name "kMDItemFSName" -raw -name "kMDItemDateAdded" | xargs -0 | awk '{print $1,$4$5$6$7$8$9$10}' ; done)
else
    RESULT="Applications folder not found."
fi
echo "<result>$RESULT</result>"