Help

Check in history

g43
New Contributor

Posted on ‎08-25-2023 02:34 PM

I'm looking for a way to get the checkin history of all machines in the Org - about 500 machines, specifically I'm looking to get the history of IP addresses from which the machines checked in in the last 30 days

the JSS does preserve the history, but only the last checkin details. /var/log/jamf.log of machines preserve it but on a scale to automate pulling the file and consolidating on a daily basis sounds complicated and prone to error. any other thought on getting this/preserving the history?

0 Kudos
1 REPLY 1

AJPinto
Honored Contributor II

Posted on ‎08-28-2023 04:36 AM

Generally speaking JAMF Pro is live data only. There are some exemptions to this where JAMF redirect some macOS logs like the software update portion of the install log, but I dont think you can customize or add on to what JAMF keeps a record of.

 

From my understanding your best options are to:

  • Write an Extension Attribute to read the /var/log/jamf.log 
  • Write a policy to move a copy of /var/log/jamf.log to a sharedrive
  • Use a SIEM tool to redirect the contents of /var/log/jamf.log to SIEM.
0 Kudos