Logs for Computer Deletion from Jamf

[PatrickD]

Hi Everybody!

Just throwing this one out there in hopes that someone has been in this situation before.

This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!!

Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent.

I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so".

Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS.

Thanks in advance!

[claven · Accepted solution]

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

[claven · Accepted solution]

Hi @PatrickD

Had to do this several years ago, look for something like this in the JSS logs. Can't recall if it was in the JAMFSoftwareServer.log or the Tomcat logs.

Curt

[OMGUsername (ID: -1)] [READ] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine
 
[OMGUsernmae (ID: -1)] [DELETE] [Computer] [DATEandTIME]
                ID             39
                Name ......... MissingMachine

[PatrickD · Accepted solution]

Many thanks @claven ,

So close to the money, you pointed me in the right direction however. The log file which contains the information exactly as you have described it is the C:Program FilesJSSLogsJAMFChangeManagement.log

I found the culprit! Now I just need to mention it without sounding like I was out to get them, hehe.