Skip to main content
Question

Group Machines that have Violated Restricted Software

  • September 4, 2016
  • 5 replies
  • 42 views

Forum|alt.badge.img+8

Is it possible to make a smart group of machines that have violated a piece of Restricted Software

5 replies

davidacland
Forum|alt.badge.img+18
  • Valued Contributor
  • September 4, 2016

I've just had a look and it doesn't seem to be in the smart group criteria options.

You can use the "has xxxxx application installed" option, but there may be a delay before the info updates if inventory updates are weekly.


Forum|alt.badge.img+8
  • Author
  • Contributor
  • September 5, 2016

Yeah I was going to use this, the problem is, we have a particular piece of software that gets removed on Violation. Which then means the smart group doesn't work because they don't have it.

It doesn't even appear in the event logs!!


dpertschi
Forum|alt.badge.img+19
  • Contributor
  • September 5, 2016

As I recall restricted software actions are logged in the JSS server log if that helps you at all.


Forum|alt.badge.img+8
  • Author
  • Contributor
  • September 5, 2016

I will have to try and have a look. Not sure where the server logs are though


Forum|alt.badge.img+13
  • Valued Contributor
  • October 5, 2016

A lazy man's way to do this would be emailed on violation, if you don't have direct access to the server log. It would be a lot more labor intensive to translate it all from email to static computer groups, but it is possible. Although a script and the API might work...