Skip to main content

Hi Everybody!



Just throwing this one out there in hopes that someone has been in this situation before.



This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!!



Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent.



I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so".



Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS.



Thanks in advance!

Hi @PatrickD



Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.



Curt



[OMGUsername (ID: -1)] [read] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
 OMGUsernmae (ID: -1)] iDELETE] eComputer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

Many thanks @claven ,



So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.log



I found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.



I wonder where these logs are in cloud instances of JAMF?  They're not in the server logs.

Reply


Terms & ConditionsCookie settings