Extension Attribute not pulling back data

[mgoodall]

Hi!

I have this EA but i am sure that it is not pulling back the data for all of the machines that we have.

#!/bin/sh

Application="/Applications/PCClient.app"
if [ -e "$Application" ]; then
lastOpen=`mdls "$Application" -name kMDItemLastUsedDate | awk '{print $3,$4}'`
echo "<result>$lastOpen</result>"
fi

I have around 50 machines that have not reported any date, yet when I login to the machines remotely the application is running.

I know that the EA is only updated when the inventory is updated, but a machine that updated at 7 am this morning had the EA as empty.. I logged into the machine this afternoon, the application was running as I would have hoped.

I created a policy that runs once, to force an inventory update, and once this had run the EA was populated.. What am I missing here?

[easyedc]

I'm curious what happens if you copy the EA script locally and run it on one of the affected Macs? Do you get any errors there? or does it spit out an unexpected message?

[mgoodall]

Well...

I ran the command on a machine that was returning {null} and found that it also returned {null}

So I ran this instead

US-LIB-iMac:bin user$ mdls -raw /Applications/PCClient.app

and got the results below

0(
    "PCClient.app"
)biz.papercut.pcng.client2020-10-12 10:00:22 +00002021-03-09 10:22:34 +0000com.apple.application-bundle(
    "com.apple.application-bundle",
    "com.apple.application",
    "public.executable",
    "com.apple.localizable-name-bundle",
    "com.apple.bundle",
    "public.directory",
    "public.item",
    "com.apple.package"
)2021-03-09 10:22:34 +0000PCClient(
    "x86_64"
)2021-03-09 10:22:34 +00002020-10-12 10:00:22 +000016(null)01(null)0PCClient.app180065207159Application(
    en

I could see from comparing these results to the ones on my machine that today's date is not present anywhere in the results.. hence the null value even though I had just logged into the machine and it would have run the app from the LaunchAgent.

So I went into Activity Monitor and force quit the app and re-loaded it and ran the -raw command again

US-LIB-iMac:bin user$ mdls -raw /Applications/PCClient.app

0(
    "PCClient.app"
)biz.papercut.pcng.client2020-10-12 10:00:22 +00002021-03-09 10:22:34 +0000com.apple.application-bundle(
    "com.apple.application-bundle",
    "com.apple.application",
    "public.executable",
    "com.apple.localizable-name-bundle",
    "com.apple.bundle",
    "public.directory",
    "public.item",
    "com.apple.package"
)2021-03-09 10:22:34 +0000PCClient(
    "x86_64"
)2021-03-09 10:22:34 +00002020-10-12 10:00:22 +000016(null)01(null)0PCClient.app180065207159Application(
    en
)2021-03-10 17:56:12 +000065207159658268162(
    "2021-03-10 00:00:00 +0000"
)20.1.2.55841

I now find that it has the current date and time 2021-03-10 17:56:12.

I ran the kMDItemLastUsedDate command again and...

US-LIB-iMac:bin user$ mdls -name kMDItemLastUsedDate /Applications/PCClient.app

kMDItemLastUsedDate = 2021-03-10 17:56:12 +0000

US-LIB-iMac:bin user$

Forced and inventory update and Bingo, the date has been populated!

Tested on another machine and got the same results with {null} so rather than force quit and re-load the app, I restarted the machine logged back in, and ran the script again, still null.. forced quit and re-loaded and I get the date..

Hmm... so maybe I could run a policy on the smart group for machines showing as not run, force quit and re-load the app and then force an inventory update.. the plot thickens!

[mgoodall]

Created a script for force kill and re-open the application and scoped that to a smart group of only the devices with no EA date for PCClient Last Run.

#!/bin/sh

#FORCE QUIT PCClient.app
pkill -f PCClient.app
sleep 10

#RUN PCClient.app
currentUser=$(stat -f%Su /dev/console)
sudo -u "$currentUser" open -a /Applications/PCClient.app
sleep 10

Worked like a charm and my number of machines that were not reporting a date is now coming down.

Why this happening I am unsure, it must be an issue or bug within the older MacOS