Lock Computer - Is there a log file for this command?

elund
New Contributor III

A MacBook was locked down yesterday, but no one in our office pushed that command out. Is there a log file somewhere in the JSS that would show the user that sent that command out? I have not been able to locate any logs regarding this.

2 REPLIES 2

rdwhitt
Contributor II

If you have change management enabled in the JSS system settings, you can search the changemanagement.log on the JSS. We're on RHEL so it's located at /usr/local/jss/logs/JAMFChangeManagement.log. You'll be looking for the "Computer Remote Lock Command" and the id of the computer, which you can get from the URL when viewing the computer record.

We offload our change management logs to Graylog which makes searching for something like this a snap.

3b73f49c286a480d8202ef27c5289906

elund
New Contributor III

Thank you for that info! I'll take a look there!