Does JAMF log script execution

[bazcurtis]

Hi,

Is there a way to find which scripts have been run from JAMF Pro on a Mac? I think we might have a rogue script being run on our machines and want to be able to check the Mac end.

Any help would be much appreciated. 

[Ismere]

Jamf is writing its log locally in /private/var/log/jamf.log but this will only tell you what was run from the Jamf perspective. Mainly in form of Check-In Massages and the Name of the executed Policy. So if you know which Policy the Script is part of you can check the log on the Machine. In a regular Case there should not be any difference between the local log and the Jamf one.

There is also this script: https://github.com/kc9wwh/logCollection which Collects logs from your Mac and attache them to the inventory in Jamf. This has a warning on it cause it will take a huge amount of resources from your server if you are doing it regularly.... so only use it if absolutely  necessary and clean up afterwards.

Checking the local log directly on the machine is my preferred way when i think there could be a difference in the local and the server log for a specific Mac.

[Tangentism]

As well as what Ismere has said, you can check through the management panel history logs for the device.

If you dont know what policy is running the script, you could write an API script to read each policy to find which one it is. Its a little bit involved but is a good exercise to get you started on them!

[bazcurtis]

Thanks for the help. I will take a look.