Group Machines that have Violated Restricted Software

I've just had a look and it doesn't seem to be in the smart group criteria options.

You can use the "has xxxxx application installed" option, but there may be a delay before the info updates if inventory updates are weekly.

Yeah I was going to use this, the problem is, we have a particular piece of software that gets removed on Violation. Which then means the smart group doesn't work because they don't have it.

It doesn't even appear in the event logs!!

As I recall restricted software actions are logged in the JSS server log if that helps you at all.

I will have to try and have a look. Not sure where the server logs are though

A lazy man's way to do this would be emailed on violation, if you don't have direct access to the server log. It would be a lot more labor intensive to translate it all from email to static computer groups, but it is possible. Although a script and the API might work...