Finding computers with blank "Last Check-in" value

[stevenwburt]

We are trying to trim down our JSS and have found that there are some systems that have a blank “Last Check-in” value which indicates they were not properly managed at enrollment. All attempts to isolate all of these systems with a Smart Group or Advanced Search don’t seem to work as the “Last Check-in” field is only searchable as a relative value (before/after/within/without) rather than a string (is/is not/like/is not like).

Do you know of any way we can search the JSS to find these systems with a blank “Last Check-in” value?

[strider_knh]

I either have to export the full device list and then sort by Check-in date or have my associate run a script he wrote that queries that info for each device and then places the devices without a Check-in date in a static group.

We suddenly had hundreds of these in our database a while back and have no idea why.

[rcorbin]

@strider.knh Any chance you might be able to share that script that finds machines with a blank check in date ?

[stevenwburt]

Interesting, thanks for the insight @strider.knh - I will report back if I find another solution.

[Look]

You can do it by having two groups.
A first group containing all the machines with a check in date more than 0 days ago (i.e. every machine that has ever recorded a check in date).
A second group containing all the machines not in the first group.
It's messy and JAMF should just allow searching by empty date fields (there are several feature requests to this effect floating around).

[mchit]

You can set operator to be "does not match regex" and value to be "." to find blank value.

Detail KB is here: https://www.jamf.com/jamf-nation/articles/496/using-regex-with-smart-groups-and-advanced-searches

[robmorton]

By any chance, does anyone know of a means to fix these systems? I have a system that shows...
bash-3.2# jamf checkJSSConnection
Checking availability of <JSSURL>:8443/...
The JSS is available.
bash-3.2# jamf recon
Retrieving inventory preferences from <JSSURL>:8443/...
Finding extension attributes...
Locating accounts...
Locating hard drive information...
Locating applications...
Searching path: /Applications
Locating package receipts...
Locating software updates...
Locating hardware information (Mac OS X 10.14.3)...
Submitting data to <JSSURL>:8443/...
<computer_id>7540</computer_id>
bash-3.2# jamf policy
Checking for policies triggered by "recurring check-in" for user "rimorton"...
No policies were found for the "recurring check-in" trigger.
Checking for patches...
No patch policies were found.

That does not update the Last Check-in date time on the server though. I believe all of the LaunchAgents/Daemons are in place and working. I unloaded and re-loaded the one that runs hourly (our checkin time).

[robmorton]

@mchit date fields do not allow for regular expressions unfortunately.

[devibeck]

@Look Thank you for the SG suggestions. Was concerned when when I stumbled across a device with a blank last check-in date just after reading this discussion - so I created the searches. Woot! Only 1 out of 7794. Whew.

[chris_kemp]

Unfortunately, the two groups method mentioned above is not 100% accurate - did this, it does pull the ones with no date but it's also pulling machines with a date...so maybe Smart Groups aren't as smart as they need to be?

[swapple]

Once the blank check in date computer is found, what is done to get the check in date to show up?

[sdagley]

@swhps That will depend on why it's not checking in. It could be that you need to re-enroll the Mac, it might be the user installed something like the Charles Proxy tool and they need to turn it off when not debugging something. Think of the Smart Group showing blank check in dates as a list of machines you're going to need access to, or have the user assist with diagnostics if remote.