Skip to main content
Question

capturing the Install Date of apps?

  • April 10, 2020
  • 8 replies
  • 98 views

Forum|alt.badge.img+4

Has anybody ever figured out how to do this? I've got a script that captures "Last Opened" but I have never been able to crack the "App installed on" nut and it would be very useful when constructing Application Usage reports....

8 replies

talkingmoose
Forum|alt.badge.img+36
  • Community Manager
  • April 10, 2020

This only works for Apple installer packages since nothing logs when a drag-and-drop app was copied to the Mac. Keep in mind this is only the original install date not the last time the app was updated.

https://gist.github.com/0cefc38d6b835167f5db95231e0050e9


Forum|alt.badge.img+13
  • Contributor
  • April 10, 2020

This will show all App Store and .pkg based installs and updates starting from the day the system was set up to the current date.
You should be able to slice it up however you need.

softwareupdate --history --all | sed '/----/d; /Display/d' | grep -v softwareupdated

Forum|alt.badge.img+10
  • New Contributor
  • April 11, 2020

can you post the script for last opened please, thanks


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • April 11, 2020

@jkryklywec here's what we use:

$ mdls /Applications/Packages.app -name kMDItemLastUsedDate | awk '/2020/{print $3}'
2020-04-08

Forum|alt.badge.img+31
  • Honored Contributor
  • April 13, 2020

Spotlight can do this, but mind you it changes anytime an update is applied. So for example, if you have a Mac that has been actively deployed for two years, it won't show that the original time on disk was 2 years ago, it will go off the last modification.

% mdls -raw -name "kMDItemDateAdded" /Applications/Firefox.app
2020-04-10 18:31:50 +0000

Using the -raw switch it will just return the value of the key you are querying for so no need to awk or sed or grep


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • April 13, 2020

@tlarkin nice, thanks! Curious how your output didn't include your prompt? Tried both bash and zsh:

$ mdls -raw -name kMDItemDateAdded /Applications/Firefox.app
2020-04-13 04:36:18 +0000$
% mdls -raw -name kMDItemDateAdded /Applications/Firefox.app 
2020-04-13 04:36:18 +0000%

Works fine in an EA:

#!/bin/bash
APP_PATH="/Applications/Firefox.app"
if [ -e "$APP_PATH" ]
then
    echo "<result>$(mdls -raw -name kMDItemDateAdded "$APP_PATH")</result>"
else
    echo "<result>DoesNotExist</result>"
fi

Which outputs:

$ /tmp/test.sh
<result>2020-04-09 16:10:20 +0000</result>
$

Forum|alt.badge.img+31
  • Honored Contributor
  • April 13, 2020

@donmontalvo You mean the trailing % ? It was there I just did not copy/paste it. When you capture that into a variable in the shell though, it should not include that. My guess that prompt is at the end due to how the developer prints to stdout in the shell, but like you just tested works fine in a script


JustinNichols
Forum|alt.badge.img
  • New Contributor
  • April 29, 2022

Hi Everyone,

We actually had a request by an internal team to get the install dates from JAMF. I was surprised this didn't come standard in JAMF itself, but with what most of you were doing here, I created a script that will output all the applications and their installed date into the attributes. Hope this helps others as it took a few days to get it worked out.

#!/bin/bash #Created by Justin #This will do a loop through all the applications located in the users mac# if [ -d /Applications ]; then RESULT=$(for i in $(find /Applications/ -maxdepth 1 -name "*.app" | sed 's/Applications//' | sed 's/[/]//g' | sed "s/ /*/g") ; do mdls /Applications/$i -name "kMDItemFSName" -raw -name "kMDItemDateAdded" | xargs -0 | awk '{print $1,$4$5$6$7$8$9$10}' ; done) else RESULT="Applications folder not found." fi echo "<result>$RESULT</result>"