show install dates on newly installed applications

[Leal]

Is there a way to create a report that show newly installed software? the applications inventory that is being pulled is only showing the version of the application but no the install date.

[mm2270]

Is this for your Macs, or iOS devices?

There used to be a way to collect additional information on installed applications, for Macs. I can't recall if that also included the install dates though. Perhaps not.
But regardless, it looks like that functionality doesn't exist in the 9 series. At least I can't see it under Computer Inventory Collection > Software.

mdls has a way of pulling information on installation dates, but I don't know how you'd incorporate that into Casper other than perhaps an Extension Attribute.

[Leal]

Yup, this is for Macs.

[mm2270]

Yeah, figured. Well, good news is there are some possible options. On iOS you'd pretty much be out of luck unless it was something built into the MDM spec.

Casper does capture Hardware/Software change information, I think by default? Can't recall now if that's something you need to enable, but I don't believe it is. Unfortunately, while it can show you what was added and removed from a software standpoint, its limited to one system at a time (shows up under one the additional tabs in the detailed inventory under version 9.x) To my knowledge you can't export this out or report on it, but someone at JAMF may know of some way to build a MySQL query to export something out. Not sure how helpful that would be for you though.

The other thought I had was to use a once a week script triggered by a policy to generate a list of any applications added during that timeframe, and either drop it into a file that can later be scooped up into an Extension Attribute, or, you could script something to use the API to upload the resulting file to the computer's record as an attachment. The latter won't allow you to really create a report, but would be a downloadable file for any Mac showing what was installed/added during the last X days. it could be any timeframe you want for that. 1 week, 14 days, etc.

Would that help? If so, I can post a script example.

[Leal]

Thanks for the response mm2270. I would really just need the data to populate somewhere in the clients inventory. We currently have a report in SCCM that shows recent software changes. If I can get the information for recent applications changes from casper clients I can combine both sets of data (SCCM/CASPER clients) into one report.

Hope this makes sense :)

[Snickasaurus]

In Linux you can 'stat' a file/folder then run it against some absolutely magical sed/awk arguments. Stat is included with OS X but the output is different. Perhaps play around with it and see what you get. Good luck and please post any findings or solutions you come across or work up!

thismachine:~ username$ stat /Applications/Firefox.app
16777220 492105 drwxr-xr-x 5 uu656282 admin 0 170 "Nov  7 18:51:25 2014" "Nov  7 18:20:28 2014" "Nov  7 18:20:28 2014" "Jun  5 22:29:41 2014" 4096 0 0 /Applications/Firefox.app

[Leal]

Hey Snickasaurus,

I actually already figured out a script that will pull applications information and modified date. The base of the script is system_profiler SPApplicationsDataType | awk -f appdata_parse.awk

my issue now is that if I need to figure out how to create a table of the data that I pulled. For now Extension attributes only show as one line which would make the ouput of the script hard to read.

[mm2270]

@Snickasaurus - stat gives good information, but as you say, its output isn't in the friendliest format. Plus, to get a list of only recently added applications would probably require looping through all installed applications and running a stat on each one and parsing out the relevant entries. Seems like too much work to me.

@Leal, here is the script I came up with when looking at this particular problem. I can't take complete credit for the spotlight syntax in it (mdfind). I got that by creating a Smart folder in the Finder and opening the resulting smart folder in TextWrangler to examine the mdfind syntax, so I cheated a little, but it gets the job done.

The below will pull a list of any applications added within the last 7 days and output it into a tab separated format, which can either be dropped into an EA, or sent out to a local file to be picked up in some other way. Right now its in EA format, but you would just need to change the echo <result> line to send the data to a file.
Also, change the "days" variable to some other value to get different results.

#!/bin/bash

days="7"

AppsInLastX=$(mdfind -onlyin /Applications/ 'kMDItemContentTypeTree=com.apple.application && InRange(kMDItemDateAdded,$time.today(-'${days}'d),$time.today(+1d)')

if [ ! -z "$AppsInLastX" ]; then
    while read app; do
        baseAppName=$(echo ${app} | awk -F'/' '{print $NF}')
        installDate=$(mdls -name kMDItemDateAdded "${app}" | awk '{print $3,$4}')
        appList+=($(echo "${baseAppName}	${installDate}
"))
    done < <(echo "$AppsInLastX")
    echo "<result>$(echo -e "${appList[@]}" | sed 's/^ *//g')</result>"
else
    echo "No recently installed apps found"
    echo "<result>None</result>"
fi

Here is an example of the results from my Mac when I run it:

Packages.app    2014-11-07 17:22:25
Firefox.app 2014-11-01 20:39:51
FastScripts.app 2014-11-02 03:31:36

Also, its only looking in the main Applications directory, not in paths like /Library/Application Support/ etc. You can either remove the -onlyin /Applications/ to have it search the whole system, or add in additional paths. For example, if you change it to:

mdfind -onlyin /Applications/ -onlyin /Users/

it will look in both /Applications/ and /Users/ so it would find installed apps in any user directories.

[Snickasaurus]

@mm2270][/url
Indeed it would be quite the scripting challenge. Fantastic job on the use of mdfind. I've added your script to my Dropbox so I can tare it apart and play around with it.

@Leal][/url
Depending on how you want your multi line output to work you might can use my Java Vender report script. Take a peak at the last line that reports as ExtensionAttribute.

# Find out if it's Apple's Java or Oracles Java
javaVendor=$(/usr/bin/defaults read /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleIdentifier)

if [ "$javaVendor" = "com.oracle.java.JavaAppletPlugin" ]; then
        ven=Oracle
elif [ "$javaVendor" = "com.apple.java.JavaAppletPlugin" ]; then
        ven=Apple
elif [ "$javaVendor" = "" ]; then
        ven=Missing
fi

# Get the CFBundleShortVersionString to print the full version
shortVersion=$(/usr/bin/defaults read /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist CFBundleShortVersionString)

# Are automatic updates allowed
updateAllowed=$(/usr/bin/defaults read /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist SUAllowsAutomaticUpdates)

# Is the checking of updates allowed
updateCheck=$(/usr/bin/defaults read /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist SUEnableAutomaticChecks)

# Puttn' it all together!
/usr/bin/printf "<results>
Vender          = $ven
Version         = $shortVersion
Updates Allowed = $updateAllowed
Updates Checked = $updateCheck
</results>
"

[Leal]

@mm2270
@Snickasaurus

This is the script that we worked on. Let me know what you think. The problem I might run into in the end is formatting this data and using column to separate the date within the clients inventory.

system_profiler SPApplicationsDataType | awk -f appdata_parse.awk

appdata_parse.awk:
/^ {4}.+:$/ {
   sub(/^ {4}/, "", $0)
   last_application = $0
}

/^ +Version:/ {
   sub(/^ +Version: /, "", $0)
   version = $0
}

/^ +Last/ {
   sub(/^ +Last Modified: /, " ", $0)
   last = $0
   print last_application last ", " version 
}

[Leal]

https://jamfnation.jamfsoftware.com/discussion.html?id=14867