Macs No Longer Update Inventory

[FergusonKevin]

All of a sudden all Macs in my environment stopped updating Inventory(11/28/2018 at 10:27 PM to be exact). There are other instances running on our server and my environment is the only one seeing this. Everything else seems to be working other than Updating Inventory. When I manually run sudo jamf recon -verbose they all get stuck on System Preferences.app.

The OSx versions range from 10.12.6-10.14.1. I have an open ticket since 11/29, gave them logs, ran sudo jamf removeFramework then re-enrolled with no success, but nothing seems to be going anywhere so wanted to reach out to the community to see if anyone else has seen this.

Thanks.

[FergusonKevin]

I left out that I have enrolled 2 brand new Macs and they never update inventory at all either.

[jared_f]

Certificate problem?

[jared_f]

Is Jamf Pro whitelisted on the network level?

[BOBW]

What happens when you do a :

#!/bin/sh
sudo jamf log

from the documentation it should:
Log the IP address, action, and username to the JSS

[FergusonKevin]

Certs are up to date, we don't have any firewalls restricting jamf. Devices won't update on wired, or wireless networks. @BOBW I ran that and it worked fine. It's only the Recon command that won't complete.

[mm2270]

How about selectively disabling various inventory collection options in the settings? I'm not sure how many of them are checked, but you could try turning off all options, then seeing if a Recon completes. If it does, then something that's enabled for the collection preferences might be causing it. Try turning one back on and retest. Keep doing that until you find the option that appears to be causing it to get stuck.

BTW, it might seem like it's getting stuck on System Preferences.app, but that might not be the case. The jamf binary, or more specifically the recon option, was made multi-threaded some time back, which means several collection options run concurrently. So it might look like it's getting stuck there, but it might be on something else entirely.

[FergusonKevin]

@mm2270 Thats good info thanks! I've already went in and disabled all inventory collection options one at a time until none were checked and it still fails.

[BOBW]

@FergusonKevin Do you know how to use Wireshark?
Just to confirm it is not a network issue.
Might need to send the logs to your network team if you are not sure.
Very strange the

sudo jamf log

works, from what I understand it uses the same process but just less information.

[chris_kemp]

Is it only Inventory Updates? Are the machines still checking in?

[Look]

As @mm2270 said, look at what is being collected.
There was a known bug with "Collect available software updates" which would prevent inventory collection due to a naming issue from Apple. Not sure if it has been resolved as I still have this disabled.

[FergusonKevin]

@BOBW Yeah Good idea I'll run Wireshark while running the command just to see what happens.

@chris.kemp Yes only Inventory Updates, machines check in and run everything else just fine.

@Look I've gone as far as disabling everything under the Inventory Collection settings and it still won't complete.

[mm2270]

Well, this is a strange issue. Was anything pushed/installed on these Macs before the problem started? Was the Jamf server upgraded at all? I'm guessing you would have mentioned such important details already if this were the case, but just asking on the off chance.

Going back to your first post, noting this

There are other instances running on our server and my environment is the only one seeing this.

Can you expand on this a little? Are you an MSP, or is your environment hosted by one? Or do you mean Jamf told you your environment is one of several instances on the same virtual server?

I can't imagine what could cause all of them to stop completing a recon all of a sudden, without some outside influence. Something must have changed somewhere to cause this.