Skip to main content
Question

Lock Computer - Is there a log file for this command?


Forum|alt.badge.img+9
  • Contributor
  • 40 replies

A MacBook was locked down yesterday, but no one in our office pushed that command out. Is there a log file somewhere in the JSS that would show the user that sent that command out? I have not been able to locate any logs regarding this.

2 replies

Forum|alt.badge.img+7
  • Contributor
  • 77 replies
  • November 17, 2016

If you have change management enabled in the JSS system settings, you can search the changemanagement.log on the JSS. We're on RHEL so it's located at /usr/local/jss/logs/JAMFChangeManagement.log. You'll be looking for the "Computer Remote Lock Command" and the id of the computer, which you can get from the URL when viewing the computer record.

We offload our change management logs to Graylog which makes searching for something like this a snap.


Forum|alt.badge.img+9
  • Author
  • Contributor
  • 40 replies
  • November 21, 2016

Thank you for that info! I'll take a look there!


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings