Logs for Computer Deletion from Jamf

PatrickD
Contributor II

Hi Everybody!

Just throwing this one out there in hopes that someone has been in this situation before.

This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!!

Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent.

I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so".

Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS.

Thanks in advance!

2 ACCEPTED SOLUTIONS

claven
New Contributor III

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

View solution in original post

PatrickD
Contributor II

Many thanks @claven ,

So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.log

I found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.

60a6b4904abe4338989c52f1a469a65d

View solution in original post

2 REPLIES 2

claven
New Contributor III

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

PatrickD
Contributor II

Many thanks @claven ,

So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.log

I found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.

60a6b4904abe4338989c52f1a469a65d