Excessive command: Profilelist

[chicaked]

Hello all, I'm hoping someone can help point me in the right direction regarding the following:
We're seeing huge connection spikes on our JSS which is maxing out.

While troubleshooting I'm seeing the below image for some machines:

...along with that in there jamf.logs I'm also seeing

I'm assuming they go hand in hand, but what I'm need to know is why would this command be running so often? I would appreciate any pointers and on how to troubleshoot further.

Thank you,

[were_wulff]

@chicaked ,

It's possible that you're running into PI-002379 on those machines; with PI-002379 we see user level MDM commands get queued up after the user logs out.

The three commands frequently seen are:
DeviceInfoITunesActive DeviceInfoAccountHash ProfileList

These commands will not complete until pushed again while that user is logged into that computer. Once the user logs back in to that computer, the commands should push through.

In most cases, it's not an issue as the commands will just push through the next time the user logs in to that computer, however in environments where that user might never log in to the computer again or where it may be awhile before they log back in and/or multiple people also log in/out of the computer, the commands can pile up and cause issues.
We see this most frequently in lab style setups where users log in with their AD credentials, but it can happen in any scenario where a user logs in with AD credentials, then logs out and doesn't log back in to that specific computer for awhile.

If you're seeing that it's happening even when the user is logged in to the computer and it's just the command repeating and completing over and over (instead of staying on 'pending' until the user logs back in), it's likely something different from the PI mentioned, and I'd recommend getting in touch with your TAM to dig into it a bit deeper.

Thanks!
Amanda Wulff
Jamf Support

[chicaked]

Hello @amanda.wulff

Thank you for your response. So with that said would I be correct in thinking that these commands on each instants are not connecting back to the jss? and that it would not be this that is contributing to the maxed connections we are currently experiencing?

Regards,

[were_wulff]

@chicaked ,

That would depend on whether they are still in a pending status (they may or may not show, especially if it's a case where the same user logs in/out of a particular computer throughout the day; once they log back in, the command will go through and show as completed) or not and whether it's all for the same user; as those are cropped out of the screenshots (as they should be, we certainly don't want end user user names being posted to public forums!) I'm unable to answer that for sure.

It would be best if you get in touch with your TAM so they can take a closer look and dig into it a bit deeper to eater confirm the PI I mentioned or to rule it out as a cause of what's happening in your situation. They'll be able to look at the unedited screenshots and will be able to take a look at log files that we wouldn't want to post here for privacy reasons.

You can get in touch with your TAM by either giving us a call, sending an e-mail to support@jamf.com, or by using the My Support section of Jamf Nation.
When you contact them, it would be a good idea to let them know about this thread and that we suspect that there might be a PI involved, so they will have an idea of where to start and how to go about either confirming or ruling out the PI as a cause of what you're seeing.

Thanks!
Amanda Wulff
Jamf Support

[chicaked]

Again thank you @amanda.wulff , we have taken your advice and are in touch with our TAM regarding this.

But just so there are no un-answer questions for others, here is a better view of the console. These command are in a completed state.

[were_wulff]

@chicaked ,

Though I'm sure your TAM will ask, it may be helpful for others here to know: For that particular computer, is it the same user that uses it and/or does that particular user--if it is the same user--frequently log in and out of the computer?

If that computer does have a user (or users) that frequently logs in and out, we would likely see a whole mess of completed ProfileList commands if we're running into the PI mentioned; if the user(s) of that computer does not frequently log in and out, there is likely something else going on and not related to the PI.

Thanks!
Amanda Wulff
Jamf Support

[chicaked]

@amanda.wulff

This computer and all the others that we have seen are single user machines, one owner that logs in with one user account. And like with most mac users these day, the machine is rarely logged out of.

Thank you,

[were_wulff]

@chicaked ,

Thanks for that update! Since the computer in question isn't a lab-style computer and doesn't appear to be logged out of frequently, it's unlikely that we're running into that PI and something else is going on.

We only see the behavior in that PI when it's a computer in which the user logs out regularly, as the commands only start to build up when the user is logged out, then push through when the user logs back in (if they ever log back in).

Knowing that will let your TAM rule out the PI and begin digging in to whatever else may be going on with the affected computers.

Thanks!
Amanda Wulff
Jamf Support

[timbmartens]

I was wondering if there was a solution that you had found on this @chicaked or @were.wulff ? I have run into this problem a number of times on the iPads I am managing at a school. I am attaching a screenshot of a user I just found this problem with that has over 148,000 completed commands. It looks like it is repeating these commands over and over and marking them as complete, although they have not completed.