Create an extension attribute that reports last reboot for a mac

[jfreeseman]

How would I create an extension attribute that reports back on a mac's last reboot. I know by typing in "last reboot" in terminal, I can get a response with the most recent times a mac was rebooted. I am looking for a nice way to back up claims by users that they "just restarted" when I ask when they did. Any help is appreciated.

[stevewood]

I would just use uptime from the Terminal:

#!/bin/sh

upLong=`uptime`
/bin/echo "<result>$upLong</result>"

exit 0

Could do something a little cleaner:

#!/bin/sh

# set some variables and grab the time
days=`uptime | awk '{ print $4 }' | sed 's/,//g'`
num=`uptime | awk '{ print $3 }'`

echo "<result>$num $days</result>"

[chris_kemp]

Just because I could... :D This one should give you a formal time & date readout of the last boot:

#!/bin/sh

lastboot = `last reboot | tail -3 | head -1 | awk '{ print $6 " " $3 ", " $4 " " $5 }'`

echo "<result>$lastboot</result>"

The output would be:

06:55 Fri, Feb 1

where $6 is the time, $3 the day, $4 the month and $5 the date.

Interesting - I was not aware of the "last boot" command before this. :~) Thanks for piquing my curiosity!

[acdesigntech]

can't take credit for it, but this is what I use to determine uptime in days. 1 day or less of uptime is considered 1 day

#!/bin/bash
# Commands required by this script
declare -x awk="/usr/bin/awk"
declare -x sysctl="/usr/sbin/sysctl"
declare -x perl="/usr/bin/perl"

declare -xi DAY=86400
declare -xi EPOCH="$($perl -e "print time")"
declare -xi UPTIME="$($sysctl kern.boottime |
                        $awk -F'[= ,]' '/sec/{print $6;exit}')"

declare -xi DIFF="$(($EPOCH - $UPTIME))"

if [ $DIFF -le $DAY ] ; then
        echo "<result>1</result>"
else
        echo "<result>$(($DIFF / $DAY))</result>"
fi

[PeterClarke]

Hi, I was going to say that chris kents code is not quite correct...

Since the LastBoot - should be just that the last time booted..
The fault is due to the tail -3 command.

Depending on how many reboots the system has had, other commands may appear to produce similar results..
But really you want to read from the top of the list, so "head -1" is needed to do that (in bash).

What you need is something like this:
------------------------------------------------------------
#!/bin/bash
LastStart=$(echo $(echo $(last reboot | head -1)) | awk '{print $3" "$4" "$5" "$6}')
echo “<result>$LastStart</result>”
------------------------------------------------------------

The ordering of the awk parts depend on what date format you want to output.

If you break that down into two parts (for debugging) you get:

LastStart=$(echo $(last reboot | head -1))
echo “1: LastStart: $LastStart”

LastStart=$(echo $LastStart | awk '{print $3" "$4" "$5" "$6}'))
echo “2: LastStart: $LastStart”

Then you can see what's going on..

I was unaware of the "last reboot" command too !

[jfreeseman]

Thank you very much everyone for the responses. I am very inexperienced in terminal so I figured I would go to the experts.

Thanks again

[denmoff]

One thing to note would be that if this is set as an extension attribute, it will only be accurate up to the last inventory update run. I wouldn't expect it to "prove" that the user rebooted unless they also ran an inventory update immediately after.

[jfreeseman]

Thank you very much everyone for the responses. I am very inexperienced in terminal so I figured I would go to the experts.

Thanks again

[mm2270]

Many many ways to skin this cat. I actually like what someone posted here a long while back on using sysctl.

in particular, take a look at sysctl kern.boottime. You can grab the information from the output like this-

sysctl kern.boottime | awk -F'} ' '{print $NF}'
Tue Feb  4 12:18:10 2014

or, if you want to change the order, send it through another awk line, like so-

sysctl kern.boottime | awk -F'} ' '{print $NF}' | awk '{print $NF,$2,$3,$4}'
2014 Feb 4 12:18:10

There's also a "seconds" field from the output that you can pull and send through a date command to format it in whatever format you want later, for example, if you wanted to set up an actual "date" Extension Attribute. Then you could use before, after and other modifiers for Smart Groups.

Edit: whoops, I see @acdesigntech already posted on using sysctl. I think that's the best way to go personally.

[pditty]

I agree with denmoff. Depending on the frequency your inventory scans are set too (mine are every 7 days) I don't see any value in using an extension attribute in your scenario. SSH(ing) into the Mac from a terminal as part of the service call would give you realtime info.

I know exactly what your talking about when dealing with users. Many think placing the computer into sleep, or logging out then back in is the same as rebooting the system. I feel your pain...

[bentoms]

You could have a policy run @ startup that writes a dummy receipt that contains or is named the current date & time to a file (i.e a dummy receipt).

Then have an extension attribute that reads this file & run a recon as part of the startup policy.

[chris_kemp]

@PeterClarke, thanks for the correction. :) I did that one Q&D, and didn't realize that the list on my machine generated by "last reboot" was actually rolling over to last year... =:o