Skip to main content
Question

Does JAMF log script execution


Forum|alt.badge.img+6

Hi,

Is there a way to find which scripts have been run from JAMF Pro on a Mac? I think we might have a rogue script being run on our machines and want to be able to check the Mac end.

Any help would be much appreciated. 

 

3 replies

Ismere
Forum|alt.badge.img+7
  • Contributor
  • 66 replies
  • August 9, 2022

Jamf is writing its log locally in /private/var/log/jamf.log but this will only tell you what was run from the Jamf perspective. Mainly in form of Check-In Massages and the Name of the executed Policy. So if you know which Policy the Script is part of you can check the log on the Machine. In a regular Case there should not be any difference between the local log and the Jamf one.

There is also this script: https://github.com/kc9wwh/logCollection which Collects logs from your Mac and attache them to the inventory in Jamf. This has a warning on it cause it will take a huge amount of resources from your server if you are doing it regularly.... so only use it if absolutely  necessary and clean up afterwards.

Checking the local log directly on the machine is my preferred way when i think there could be a difference in the local and the server log for a specific Mac.


Tangentism
Forum|alt.badge.img+10
  • Honored Contributor
  • 144 replies
  • August 9, 2022

As well as what Ismere has said, you can check through the management panel history logs for the device.

If you dont know what policy is running the script, you could write an API script to read each policy to find which one it is. Its a little bit involved but is a good exercise to get you started on them!


Forum|alt.badge.img+6
  • Author
  • Contributor
  • 68 replies
  • August 10, 2022

Thanks for the help. I will take a look.


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings