Creating valid Smart Groups

[aamjohns]

I am wondering, how does one know for sure what a valid field element is for a smart group criteria? Since a selection box is not presented giving available options, I have so far done it based on comparisons to the inventory values. But, I am curious if there is a sure fire way of knowing what is a valid option? For example, I wanted to create a SG for 10.8.3 OS. If I select Operating System the inventory says 'Mac OS X'. Another option is 'Service Pack'. In the inventory 10.8.3 would be under 'Operating System Version' but I do not see that in SG. So I am wondering, in the general sense, how to determine valid values for Smart Groups (SG). Is it a 1-1 relationship with inventory field names?

I should add that I am aware that one can experiment by creating a group using the desired criteria and then seeing if the group is populated. My question is really about understanding the nature of smart group criteria in general - without having to do test runs.

Thanks,
Aaron.

[stevewood]

Some SG will present a selection box, indicated by three elipses next to the input box. I see those when building SGs based on licensed software or based on Casper receipts.

In your example of wanting an SG of 10.8.3 users, you would choose Operating System Version, use the Like test and put 10.8.3 in the input box. Here's a screen shot of mine:

http://cl.ly/image/222j1G033d3w

When dealing with a version item, like OS or application version, you just need to use the numbers that are associated with that item. For example, to find all Office 2011 installs, you might use "Application version like 14.".

Hope that makes sense.

[aamjohns]

Hi,
Makes sense and I appreciate your response.

I'm not arguing with you, but to be specific, and gets at the question of my post, your screenshot demonstrates 'Operating System' which in the inventory has the value of Mac OS X but what we are really getting (yes I tested it) is what is listed in inventory as 'Operating System Version'. So the heart of my question, and maybe there is not an answer, is... Is there a predefined way to know what the valid values are for a query element when there is not an ellipsis. I realize I am being highly specific here, but I am just trying to get the heart of the matter which is a way to check to see what is a valid value.

I can certainly live without an answer... Like I said you can always just make a test group to see if you are getting an expected result - thereby knowing your query value is valid.

As mentioned above, and as you showed, I now know there is not a direct correlation between the exact inventory text and the associated value. Otherwise we would not have chose Operating System, we would have selected Operating System Version.

This is not extremely important, it was just a question that I thought someone might say 'you will always know by this'. And again, experience and trial and error will bring me to my own knowledge of smart group queries.

Thanks again for your response.

Aaron.

[mm2270]

@Aaron,

There is often no definitive way to know what a valid value would be for certain Smart Group criteria like you're describing. Al lot of this is going to come from experience, your own, from others or from JAMF themselves.
As Steve mentions, the ones that provide an ellipses are easy, since your choices are defined for you based on inventory information. For others, it will just take some knowledge and common sense (I'm not implying you don't have common sense, but rather that sometimes you have to go with what your common sense tells you)

And even with that, you'll WILL get some of them wrong and need to make adjustments. Some of us here have been using the Casper Suite for many years and I can guarantee you we all still come across scenarios where the SG criteria to make something work makes our heads spin and can take a bit of trial and error to get it "right" if there even is such a thing as right. Similar to packaging, creating good Smart Groups is closer to an art form than a science.

[mm2270]

Also, to try to answer your question above around the Operating System seeming discrepancy, I believe what we are seeing here is the fact that the way the JSS db stores data and how the JSS web app displays them aren't always analogous.
For example, open Terminal and type in:

sw_vers

What you'll get is 3 rows of data, Product Name, Product Version and Build Version. You can use column 2 from any of those in either a Smart Group or Advanced Search to pull up computers.
On my JSS, if I create an Advanced Search with criteria such as:

Operating System | Like |

I can use any of the following to pull up Macs-
Mac OS X
10.8.3
12D78

The first one will obviously pull up ALL Macs, the next 2 should only pull up Macs running 10.8.3, since I'm either specifying the exact version number or the build. So you see, that data is really all the same as far as the Casper db is concerned, and it will accept any of them. It just splits them up in the Web UI for us mere mortals to make better sense of it :)

The "Service Pack" item is there because the Casper Suite can inventory Windows PCs as well, so you can use that to gather PCs that have say XP SP3 or something.

Make sense?

[aamjohns]

Ok, thank you Steve and mm2270. I believe between the two of you the answer is covered.

I appreciate your responses and have a better idea of SG. * I would select 'mark as answer' but I feel it is the combination of both responses which comprise the answer. So I will not choose the answer.

Thanks!
Aaron.

[aamjohns]

One more question. I want to create a smart group that I will use to determine if a system is a candidate for the Office 2011 14.3.4 update. The software version needs to be 14.1.0. Since I cannot do an = or > than 14.1.0 I am wondering how I could construct such a query or smart group. In this case, and I have not looked, maybe 14.1.0 would cover our installs (I assume that is office 2011 with SP1) but at the same time this concept is something I've been wondering about, a SG for verison is = to or > than.

The update criteria also says the OS needs to be 10.5.8 or greater. So again, that would be an example of a = to or > than query.

Thanks, Aaron.

[mm2270]

Do something like this for your Office update SG-

Application Title | Has | Microsoft Outlook (or Word, Excel, etc)
[and] Application Version | like | 14.1.
[or]  Application Version | like | 14.2.
[or]  Application Version | like | 14.3.
[and] Application Version | is not | 14.3.4

If you feel you need to throw the OS version check in there, you can use similar logic as above to add to the SG, looking for Macs running Operating System | is | 10.5.8 [or] like 10.6.. [or] like 10.7. [or] like 10.8.

The only way you could make this easier would be to build individual Extension Attributes set up as integer values to capture the versions of Office, the OS and other stuff. Then you would be able to use a = or > or < type logic.
But whether that's actually "easier" is a bit subjective. You could really get out of control with how many Extension Attributes you end up creating. Keep in mind the more of those you have, the longer the recon process takes.

[stevewood]

I believe this will get you what you are looking for:

http://cl.ly/image/1q2C1V1e153f

Version like 14.1, or Version like 14.2, or Version like 14.3

Then your OS is version like 10.6, or Version like 10.7, or Versioin like 10.8

A quick test on my system and that worked for me. I use Word as the application to key off of.

[aamjohns]

Right on. That will work. Thank you for that. And I too use the version of the Word app to key off of...

Regarding:

But whether that's actually "easier" is a bit subjective. You could really get out of control with how many Extension Attributes you end up creating. Keep in mind the more of those you have, the longer the recon process takes.

That is exactly what I am trying to avoid. Since I am building the infrastructure I am trying to do it the best I can from the start so I do not wind up with a mess down the road. Thank you for pointing that out.

Aaron.

[aamjohns]

In case anyone finds this thread helpful I thought I should bring this up. I used the proposed logic above. I'm getting an unanticipated result.

I've got a test system with 14.3.4 installed that I am testing against.
This works (when I say it works I mean the test system is not a member of the smart group, as expected):

Application Title | Has | Microsoft Word [and] Application Version | like | 14.1. [and] Application Version | is not | 14.3.4

Next, if I add:

Application Title | Has | Microsoft Word [and] Application Version | like | 14.1. [or] Application Version | like | 14.2. [and] Application Version | is not | 14.3.4

Now the system is a member of the SG (not desired result).

If I toy with it and change it to:

Application Title | Has | Microsoft Word [and] Application Version | like | 14.1. [or] Application Version | like | 14.2.1 [and] Application Version | is not | 14.3.4

Once again the system is not a member of the SG.

Sorry if you are thinking 'geez dude just figure it out' but I thought it may be worth discussion.

You would think the criteria '[and] Application Version | is not | 14.3.4' would be enough to keep if from being in the SG.

Aaron.

[mm2270]

@Aaron - FWIW, If I try the same I get the same problem, Macs with Office 14.3.4 showing up in the results. As mentioned yesterday, creating Smart Groups really does take some trial and error.

So playing around with this, if I place the Application Version | is not | 14.3.4 right after the Application Title, and then the rest of the criteria, it seems to do the trick, at least for me. YMMV.

So switch it to this and see if any Macs running Office 14.3.4 show up in the group or Advanced Search-

Application Title | Has | Microsoft Outlook (or Word, Excel, etc)
[and] Application Version | is not | 14.3.4
[and] Application Version | like | 14.1.
[or]  Application Version | like | 14.2.
[or]  Application Version | like | 14.3.

On our JSS that appears to correctly get all Macs not running Office 14.3.4, but running any version of 14.1.x and up.

[aamjohns]

Hi mm2270,
I tried it. Here is a screenshot to confirm I did this right:
https://dl.dropboxusercontent.com/u/5274864/Screenshots/SG_Office_Update.png

If so, then unfortunately it does not seem to be working for me. I confirmed via inventory that Word is 14.3.4 on the test system but for some reason the SG is still picking it up. I do appreciate that you put time into this to help me.

I tried a slightly different spin on it and this may work for me in this particular circumstance although to me this is not really addressing the issue we are trying to ferret out:
https://dl.dropboxusercontent.com/u/5274864/Screenshots/SG_Office_Update2.png

Thank you again for your time. Aaron.

[Chris_Hafner]

You could also add the path to the various MS Office bits in the inventory collection section of the JSS. As for the rest, I create license templates for each version of Office app as well as the suite. It's invaluable AND gives you a defined group (i.e. you will be able to select from a list of values when creating smart groups so long as you use the "licensed software" section).

[aamjohns]

Thanks Chris that's a great suggestion.

[talkingmoose]

Throwing out an alternative...

When trying to get the version of a product suite, getting the version from one of the installed products (like Word) is convenient but it assumes the application is installed. In some cases, only one application of the suite is installed. How do you reliably get the version of the suite not knowing which applications are installed?

Back in the day when Microsoft would update the version numbers only on the applications affected by an update (that got really confusing) an Office for Mac developer told a group of us to go by the MicrosoftComponentPlugin item found inside the Office folder. This must be present regardless of which applications are installed and he guaranteed its version was always updated.

As of Office 2008, all application version numbers are revved even if an update doesn't touch an application but I still use the version of the plugin instead of an application because I can guarantee it'll be present. You can get this using an Extension Attribute such as:

#!/bin/sh

if [ -f "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info.plist" ] ; then
    VERSION=$( defaults read "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info" CFBundleShortVersionString )
else
    VERSION="Not installed"
fi

echo "<result>$VERSION</result>"

This returns something similar to 14.3.4 or Not installed.

[Chris_Hafner]

@ talkingmoose... Nice one!

[conitsupport]

Hi we have a smart group setup to 'lock' ipads with VPN's installed, problem is it appears to block them when outside of the school, we have Clustering setup and working so devices are getting info / checking in from external. we have the following rules / criteria in the group. various vpn app names using OR app name HAS betternet (name of app) we have about 15 of theses rules so far) AND ipaddress LIKE 10.64 so in theory any ipad with one of the listed ~VPN's installed and is on the school network should get the restrictions, BUt it appears to be blocking outside of the school ip range? do i need to put brackets around the ip address?

any ideas?