Inventory query of last time station booted

[jhuls]

This is actually two questions related to when systems startup.

1. I would like to be able to query in inventory when the startup time was that a computer booted up.

2. I would like to be able to log when each boot up of a system takes place.

The first I would think is very doable in Casper but will likely take an extension attribute. The second part I would think somehow requires a way to view the logs remotely and I already don't consider myself very strong on readying OS X logs let alone being able to view them remotely.

Ideas? Are there solutions already staring me in the face?

[davidacland]

This would be logged by default. If you check Computer Management Settings > Check-In > Start-up > Log Computer Usage information at startup.

This will log each time the computer starts up.

I'm not sure if this is a query in inventory (I can't see it in the smart group criteria). If that is a requirement I think an EA will be the way to go.

[mm2270]

Yes, it can be captured by default, but unfortunately is not something you can run an Advanced Search on or build a Smart Group off of. There are some items that are like this in the JSS. You can see them in a computer's record, but can't run queries against them natively in the GUI.

You can build an EA (Extension Attribute) that runs a script on the Mac each time it submits inventory to capture this though. Here's one that should populate it in a date format that works with the JSS (meaning you can build a search or Smart Group using criteria like "within last x days" or before or after a certain date)

#!/bin/sh

lastBootRaw=$(sysctl kern.boottime | awk '{print $5}' | sed 's/,$//')
lastBootFormat=$(date -jf "%s" "$lastBootRaw" +"%Y-%m-%d %T")

echo "<result>$lastBootFormat</result>"

Set it up in the JSS under Extension Attributes, change the Data Type to "Date (YYYY-MM-DD hh:mm:ss)" Once they start reporting in you'll be able to run reports on Macs with startup dates within a certain date or time range as mentioned above.

EDIT: BTW, this only addressing your first question. To see a report on each boot time would require a different process, but not sure what that would be at the moment.

[franton]

Well @mm2270][/url that's far superior to what I had ...

However there is an OS X command called "uptime". For example:

Franton-MacBook-Pro:~ franton$ uptime 17:01 up 7:38, 2 users, load averages: 1.26 1.25 1.24

Parsing that into something more readable is something i'll have a go at later tonight. The 2nd field (after up) is the actual uptime.

[mm2270]

Thanks, but I can't take full credit for it. An old post on here by someone pointed out the sysctl kern.boottime command for pulling boot time in unix seconds. Up until then I was using uptime and scripting around its output to get something usable for an uptime EA. But using the kern.bootime info allows you to format the result however you want with the date command and some math operations.
Our actual "uptime" EA calculates uptime in hours with decimal points. The EA stores the value in integer format. So for ex, a Mac may show that it has been up for "40.5" hours, or 1 day, 16 hours and 30 minutes. We can then do a search or Smart Group that uses a greater than or less than approach.

Ex: Show me all Macs that report an uptime of greater than 1 week would be:

Uptime (Hours) | more than | 168

as 168 hours = 7 days