Check in history

[g43]

I'm looking for a way to get the checkin history of all machines in the Org - about 500 machines, specifically I'm looking to get the history of IP addresses from which the machines checked in in the last 30 days

the JSS does preserve the history, but only the last checkin details. /var/log/jamf.log of machines preserve it but on a scale to automate pulling the file and consolidating on a daily basis sounds complicated and prone to error. any other thought on getting this/preserving the history?

[AJPinto]

Generally speaking JAMF Pro is live data only. There are some exemptions to this where JAMF redirect some macOS logs like the software update portion of the install log, but I dont think you can customize or add on to what JAMF keeps a record of.

From my understanding your best options are to:

• Write an Extension Attribute to read the /var/log/jamf.log 
• Write a policy to move a copy of /var/log/jamf.log to a sharedrive
• Use a SIEM tool to redirect the contents of /var/log/jamf.log to SIEM.