EA for Time Machine backup since X number of days

[damienbarrett]

I'm very successfully collecting the last Time Machine backup date using Chad Nielsen's excellent Time Machine extension attribute. Good stuff.

However, I swear that I used to be able to -- in a previous JSS (8.x or maybe even 7.x) -- see the number of days since a backup had been completed. Collecting the last TM backup date is great, but I'd love to be able to build a smart group that shows me "no backups in X number of days". This requires either collecting an integer instead of a string, or somehow parsing the TM date from the current date.

Does anyone know of a way to do this?

I'm running Jamf Pro 10.7.1, FWIW. All my clients are currently 10.11.6 until June 2019 when I replace all of them with new hardware running 10.14.x.

[mm2270]

It should be fairly easy to do by converting the date that the EA returns into Unix seconds, and then doing some math against the current Unix seconds value to get the difference, and then convert that into a days integer value.

I'm not familiar with the EA you referenced. If you could point to that, we can look at it and figure out a way to make what it returns work for what you're looking for.

[damienbarrett]

It's the one here by Chad Nielson, towards the bottom of the thread.

https://www.jamf.com/jamf-nation/discussions/13289/time-machine-extension-attribute-compatible-with-...

[mm2270]

Ok, cool. So the problem I'm running into is that I don't have TM configured on my Mac, so I have nothing in the plist I can reference. Given this, I'm not sure of the format of the last backup date. If you can post an example here, preferably a copy/paste to ensure nothing in the format gets changed, I can help with a script that would give you a "days since last backup" type of result.

If not, I will see if I can locate a system that has Time Machine configured and try to capture the value from the plist.

[damienbarrett]

Here are the last few keys in my /Library/Preferences/com.apple.timemachine.plist file that show the date format of the last few snapshots:

<date>2018-10-17T12:59:34Z</date> <date>2018-10-17T13:44:26Z</date> <date>2018-10-17T14:28:07Z</date>

And when I run Chad's script manually, it returns the same value listed there at the end, so the values match....his script is pulling the last snapshot date and time. I don't know what the Z references at the end of each snapshot timestamp.

I don't have any experience with converting timetamps to Unix seconds. I get the concept, but my experience with that is non-existent. Heading off to Google to research this a bit. Any help you can provide would be great. Thanks.

[mm2270]

Ok, cool. I was able to locate a system with TM enabled/configured and looked at the plist. I'm not necessarily seeing the date format as you mentioned, so I'm not sure if it's a difference in the OS version or something. The machine I'm checking is running 10.12.6, and I know you said most of your Macs are at 10.11.6. So not sure if that accounts for it.

However, looking at the EA script, I think the following section:

dateBackup=$(defaults read "$pathPlistNew" Destinations | 
            sed -n '/SnapshotDates/,$p' | grep -e '[0-9]' | awk -F '"' '{print $2}' | sort 
            | tail -n1 | cut -d" " -f1,2)

Can be changed to this, since the old standby PlistBuddy does a better job of reading the dates from the plist.

dateBackup=$(/usr/libexec/PlistBuddy -c "Print Destinations:0:SnapshotDates" "$pathPlistNew" | sed '1d;$d;s/^ *//g' | tail -1)

On the Mac I'm looking at, this gives me a date format like Thu Oct 04 09:09:44 EST 2018

If you decide to stay with the original script, or you continue to get the dates in the format you posted, here is some code that may or may not work with it to give you days since last backup. I can't guarantee this will always work correctly. The Z at the end of the date indicates UTC. Technically it stands for Zulu time, but it is the UTC format, which means the dates you see there may not be exactly when the backup actually occurred, depending on the actual time zone it's in.

#!/bin/bash

dateBackup=<code to get last backup date timestamp goes here>

dateBackupUnix=$(date -jf "%Y-%m-%dT%TZ" "$dateBackup" +"%s")

dateNow=$(date +"%s")

dateBackupDiff=$((dateNow-dateBackupUnix))

daysSinceBackup=$((dateBackupDiff/60/60/24))

echo "$daysSinceBackup"

Note that this gives you only whole integers, so you won't get something like 3.5 days. Only 3. Until it hits the next full day the integer won't go up, so if it's been 3 days, 23 hours and 50 minutes, it will show "3", not "4"

if you decide to use PlistBuddy to capture the date instead, you can use the following instead

#!/bin/bash

dateBackup=<PlistBuddy code to get last backup date timestamp goes here>

dateBackupUnix=$(date -jf "%a %b %d %T %Z %Y" "$dateBackup" +"%s")

dateNow=$(date +"%s")

dateBackupDiff=$((dateNow-dateBackupUnix))

daysSinceBackup=$((dateBackupDiff/60/60/24))

echo "$daysSinceBackup"

Hope the above helps get you on the right track. Let me know if it works for you.