Check if a specific application is being used in our fleet

doekman
New Contributor III

For individual computers we gather application usage logs. For every computer I can check what applications have ran at: Computer > History > Application Usage Logs.

Is it also possible to query these logs over all computers? I want to know if an specific application (Microsoft Outlook) is actually being used, say last month.

 

1 ACCEPTED SOLUTION

wkelly1
New Contributor III

You can compile this information using the Classic API, but it doesn't look like you can get a bulk list in one single call.

Pull a list of all device IDs (https://developer.jamf.com/jamf-pro/reference/findcomputers) and then find application usage for each ID (https://developer.jamf.com/jamf-pro/reference/findcomputerapplicationusagebyid)

 

 

View solution in original post

6 REPLIES 6

wkelly1
New Contributor III

You can compile this information using the Classic API, but it doesn't look like you can get a bulk list in one single call.

Pull a list of all device IDs (https://developer.jamf.com/jamf-pro/reference/findcomputers) and then find application usage for each ID (https://developer.jamf.com/jamf-pro/reference/findcomputerapplicationusagebyid)

 

 

sdagley
Esteemed Contributor II

@doekman The Advanced Computer Search->Application Usage seems geared to reporting how many hours an application has been run, not how recently it was run, so that's not going to be useful to you.

You can use an EA to collect last run info for an app, and then report that result of that EA in an Advanced Computer Search->Computers search. Here's an EA to do that for Microsoft Outlook:

#!/bin/sh

# Returns last time Microsoft Outlook was launched, or 2000-01-01 00:00:01 if app not installed

AppToCheck="/Applications/Microsoft Outlook.app"
Result="2000-01-01 00:00:01"

if [ -d "${AppToCheck}" ]; then
	Result=$(mdls -name kMDItemLastUsedDate "${AppToCheck}" | cut -f 3,4 -d \ )
fi

echo "<result>$Result</result>"

mm2270
Legendary Contributor III

You have to be careful with using the kMDItemLastUsedDate spotlight criteria, because this only gets updated on application launch. Since some most Mac users leave applications open for weeks or even months at a time in some extreme cases, you could pull an old date and it looks like the app isn't really being used.

For example, I use Microsoft Outlook every day, was just using it a minute before posting this, and when I run the above mdls command on the app, it returns this:

kMDItemLastUsedDate = 2023-03-14 10:31:58 +0000

So it looks like I haven't used the app in about a week. But a week back is when the app was quit and then relaunched, probably because of an update. It's been under heavy use by me since then.

If I run the same command on Terminal.app, it claims it was last used on 02-27-23, but of course I just used the app to run the actual command itself!

In practical terms, most apps will be restarted at some reasonable timeframe in a managed environment due to patching or forced restarts when at too high an uptime, or whathaveyou, but it's still something to be aware of. Using mdls to capture this is fine, as long as you use a relatively long time threshold, like 90 or 120 days for example, to decide if something really isn't being used. Otherwise you could end up with some false positives.

sdagley
Esteemed Contributor II

Thanks for adding the warning on mdls data @mm2270. It's definitely not a fine grain indicator of usage, but in the scale of past 30, 60, or 90 days can be useful (especially for orgs that usually enforce macOS and Office app updates).

doekman
New Contributor III

Thanks for all the feedback and ideas.

Advanced Computer Search->Application Usage can be usefull, but I didn't get any returns. Turns out, the application name is an exact match. You need to enter "Microsoft Outlook.app". When omitting Microsoft and/or ".app", nothing is returned.

In the end I went with the API solution, since this gave the information I needed. It was a bit more work than anticipated, but now I'm more familiar with the API.

 

sdagley
Esteemed Contributor II

@doekman To change the search preferences for things like applications click the person icon in the Jamf Pro console header (on the right near the gear icon), select Account Preferences, then click the Search Preferences tab. Your choices for Applications are Exact Match or Starts with