Extension Attribute Help

[kevclark]

I am trying to create an Extension Attribute to get the version of a file. The file appears to be a UNIX executable.

I worked with the company and they said I can go to the terminal and type the following command:
/Applications/sgtlabs/AristotleNT -version

The following information is returned on screen:
2019-04-09 09:04:45.127 AristotleNT[1101:15734]
Version 7.3.0.1p Copyright (c) 2004-2018 Sergeant Laboratories Inc.

I created the following script and added it to an extension attribute:

#!/bin/sh
ArisVers=$(/Applications/sgtlabs/AristotleNT -version)
echo "<result>$ArisVers</result>"

This does not do anything and the extension attribute remains blank. Looking for any help to extract and get just the version info from the output. Any help would be greatly appreciated.

[ryan_ball]

@kevclark Just to confirm, did you do a recon on the machine AFTER you created the extension attribute (EA)? EAs will only populate after a recon.

[larry_barrett]

<redacted>

[canopimp]

Is there a info.plist file inside the contents of the application bundle that contains the version info? Most apps have this, not all, but most.

[mm2270 · Accepted solution]

Might need to do something like this to get just the version. As I don't have this product, I'm just taking an educated guess

#!/bin/sh

ArisVers=$(/Applications/sgtlabs/AristotleNT -version 2>&1 | awk '/Version/{print $2}')

echo "<result>$ArisVers</result>"

This is, assuming as @canopimp mentioned, there is not an existing Info.plist anywhere that might have the version info in an easier to grab format.

[kevclark]

@ryan.ball Yes I did run a recon

@canopimp This is not an application bundle, from what I can tell it is a UNIX executable.

@mm2270 Thanks for the help. I updated the script to what you provided and it worked great. The extension attribute was populated and only showed the version (7.3.0.1p).

I am new to scripting so I really appreciate your post. Can you briefly explain what your script is doing so I can learn from this. If I had to guess the reason my initial attempt completely failed and was blank was caused by the fact that it was returning 2 lines of response.

[mm2270]

Hi @kevclark Sure.

So, the command running in the script is mostly the same as what you had already, but I added 2>&1 directly after it. What this does is make sure both stderr and stdout, which are types of outputs scripts and shell commands can produce, are combined together. The reason I did this was because some binaries output in a way that makes it hard to capture the output. We used to see this with the java -version command way back and needed to do the same thing to ensure the actual output from the command could be parsed and captured correctly. It was just a hunch that that might be needed.

The second part, which is | awk '/Version/{print $2}' is piping | the output into awk, but I'm using awk's regex matching to grab the line that has the Version string '/Version/, but instructs it to only print column 2 {print $2}' from the output. Column 2, when split on spaces is the one that has the actual version number displayed in the output.

Hope that helps explain it.

[kevclark]

@mm2270 Thanks so much for the explanation. It helps me understand what is going on and I am sure it will help others. I very much appreciate you taking the time to do that.

[coryhowell2]

@mm2270 & @kevclark Thank you for this! It has helped me also get an extension attribute up an running for one of our apps that uses a UNIX executable.

[balaji1212]

Hi Team,

Need some help here, i'm trying to get the applications list of the machine using Extension Attribute field. I'm able to get the list in a single line rather than generating them in new lines. I have tried to get the list by using , but still its not populating.

For Example : TextWrangler Adobe Photoshop Adobe CreativeCloud

But i would like to get it as below

TextWragler
Adobe Photoshop
Adobe CreativeCloud

FYI: Script is from JAMF Nation - finding 32 bit applications list in macOS machine. Any help is greatly appreciated...