EA/Smart Group to determine if a user has accessed Terminal

[blee]

I've created an EA with the script 

#!/bin/bash


echo "$(mdls "/System/Applications/Utilities/Terminal.app" -name kMDItemLastUsedDate | awk '{print $3}')"

and running it on my device, it returns 

2024-12-12

as expected. I then created a Smart Group with Criteria <Name of EA>, Operator 'after (yyyy-mm-dd)' and Value '2024-01-1'. Jamf returns a list of devices but I do not believe this list is accurate, as it does not include my device when I've been using Terminal all morning.

Any suggestions on what could be happening or what I can do to improve its accuracy?

[karthikeyan_mac · Accepted solution]

Hi @blee,

 Result of EA should be within <result>value</result>. This could also be an issue.

#!/bin/bash

echo "<result>$(mdls "/System/Applications/Utilities/Terminal.app" -name kMDItemLastUsedDate | awk '{print $3}')</result>"

Thanks 

[Shyamsundar · Accepted solution]

you need to change the date format to YYYY-MM-DD hh:mm:ss , and also you need to select your data type as DATE in the EA, try this

#!/bin/bash

date=$(mdls -r -name  kMDItemLastUsedDate /System/Applications/Utilities/Terminal.app)
formattedDate=$(date -juf "%F %T %z" "$date" "+%F %T")
echo "<result>$formattedDate</result>"

[sdagley · Accepted solution]

@blee Be aware that if you don't return a properly formatted date in the response from an EA that is configured to have a date result then your JSS will not be happy. Here's an example EA that makes sure a valid date is always returned:

#!/bin/sh

AppToCheck="/System/Applications/Mail.app"
result="2000-01-01 00:00:01"

if [ -d "${AppToCheck}" ]; then
	AppLaunchTime=$(mdls -name kMDItemLastUsedDate "${AppToCheck}" | cut -f 3,4 -d \ )
	validTime=$(echo "$AppLaunchTime" | grep "null" )
	if [ -z "$validTime" ]; then
		result="$AppLaunchTime"
	fi
fi

echo "<result>$result</result>"

[karthikeyan_mac · Accepted solution]

Hi @blee,

 Result of EA should be within <result>value</result>. This could also be an issue.

#!/bin/bash

echo "<result>$(mdls "/System/Applications/Utilities/Terminal.app" -name kMDItemLastUsedDate | awk '{print $3}')</result>"

Thanks 

[Shyamsundar · Accepted solution]

you need to change the date format to YYYY-MM-DD hh:mm:ss , and also you need to select your data type as DATE in the EA, try this

#!/bin/bash

date=$(mdls -r -name  kMDItemLastUsedDate /System/Applications/Utilities/Terminal.app)
formattedDate=$(date -juf "%F %T %z" "$date" "+%F %T")
echo "<result>$formattedDate</result>"

[blee]

Thanks for the suggestion. I've tried your script and updated my EA (also double checked that Data Type is YYYY-MM-DD hh:mm:ss) but I'm getting the same results (my device is still not listed with the new script). In the Smart Group criteria I've selected "after (yyyy-mm-dd)" as the Operator and 2024-01-01 as the Value.

Any ideas? If it can show my device in the results list I can at least it's accurate to some degree.

[sdagley · Accepted solution]

@blee Be aware that if you don't return a properly formatted date in the response from an EA that is configured to have a date result then your JSS will not be happy. Here's an example EA that makes sure a valid date is always returned:

#!/bin/sh

AppToCheck="/System/Applications/Mail.app"
result="2000-01-01 00:00:01"

if [ -d "${AppToCheck}" ]; then
	AppLaunchTime=$(mdls -name kMDItemLastUsedDate "${AppToCheck}" | cut -f 3,4 -d \ )
	validTime=$(echo "$AppLaunchTime" | grep "null" )
	if [ -z "$validTime" ]; then
		result="$AppLaunchTime"
	fi
fi

echo "<result>$result</result>"

[pete_c · Accepted solution]

Also remember that results of an EA are only returned when recon runs. 

[blee]

thank you @karthikeyan_mac @Shyamsundar and @sdagley for the suggestions! The script is working, and @pete_c 's note about EAs returning when recon runs was the final nail in the coffin. Kudos to all