Extension Attribute Not pulling Data on Some Computers

[TomDay]

I have an EA that checks for the version of XProtect. About 10% of my computers are not reporting the XProtect version in the way that the vast majority of my other computers are. Other EAs are pulling data fine on these computers that i am seeing the issue with for the XProtect EA. Can someone point me to some troubleshooting steps I can take to figure out why this small number of computers isnt pulling data from the EA in question?

Not sure if it matters but the code for the EA I found on Jamf Nation is:

#!/bin/sh

#Pulls xProtect version string

XPROTECT=`defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version`

echo "<result>$XPROTECT</result>"

exit 0

Thanks, Tom

[mm2270]

What OS are these Macs running? Are they all on the same version? I only ask because, while XProtect goes back several OS revisions, it doesn't go all the way back. Also, I think the location of the XProtect.meta.plist changed at some point, though I can't recall exactly which OS it was that happened in (and I may even be "mis-remembering" that). I guess I'm wondering if the OS version the Macs are on having the problem is because it can't locate the plist file.

[millersc]

Using the ">_" button will show code correctly. Just paste in between the hash marks.

Try this and report back:

#!/bin/sh

## Pulls xProtect version string
XPROTECT=$(defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version)

echo "$XPROTECT"

exit 0

[TomDay]

@millersc Thx for the tip, code updated!

@mm2270 A mix of 10.11.4, 10.11.3, 10.11.1, 10.10.5 and 10.10.3

[mm2270]

OK, so none of those should be affected by any of the items I mentioned.
You might have to get on one of those Macs and run a simple defaults read command against the plist to see what its returning. I guess its possible its not showing a version string.

[sean]

As a starter, try:

#!/bin/bash

XPROTECT=`defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version 2>/dev/null`
if [ $? = 0 ]
then
        echo "<result>$XPROTECT</result>"
else
        if [ ! -e /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist ]
        then
                echo "<result>xprotect file missing</result>"
        else
                echo "<result>xprotect version string missing</result>"
        fi
fi

exit 0

[TomDay]

@millersc Tried that code and my number of computers not reporting version has drastically increased from 200 to 900.

@sean Just updated to the code you suggest, will wait for computers to inventory and and keep an eye on the results as they report back.

[mm2270]

@TomDay The code @millersc posted above is not an Extension Attribute, hence why the drastic increase in machines not reporting the version. I think he meant that you needed to run that on one or more of the Macs not reporting a version to see what it was returning. Similar to what I posted. Get on one of the Macs not showing a version and directly examine the plist to see what it shows. Throwing modified EAs into your JSS as trial and error might be a lengthy process. Sometimes you just have to be hands on to see what the issue is.

[TomDay]

@mm2270 Ah OK I get it, thanks for pointing that out!

[millersc]

@TomDay I did a quick test on a 10.10.5 unit and found the code I posted does need to have

echo "<result>$XPROTECT</result>"

or else it shows blank. If you want more detailed reporting use @sean version. Then make a smart group based on the data returned.