Skip to main content
Solved

Smart group based on existence of a file?


AVmcclint
Forum|alt.badge.img+21

We've got some security software that only consists of a single binary in /sbin and a launch daemon in /Library/LaunchDaemons Some of the installs were done by our security team manually (outside of Casper) and I've been asked to make it deployable. I need to make a smart group to manage which computers don't already have it and to make sure the software isn't re-installed on top of an existing install, but I can't figure out how to set criteria to look for the presence of either of those files. Does anyone have any pointers?

  • (yes, I realize that this software won't work in El Capitan because it installs to /sbin, but we're waiting several months before upgrading anything)

Best answer by bkramps

@AVmcclint , we do something similar and the best way I have found is to create an extension attribute for the presence of the file. The Ext Attribute could be similar to this

#!/bin/sh
if [ -e /sbin/filename ]
then 
  echo "<result>True</result>"
else
  echo "<result>False</result>"
fi

Then you build a Smart Group based on that Attribute True or False value.

View original
Did this topic help you find an answer to your question?

14 replies

mm2270
Forum|alt.badge.img+16
  • Legendary Contributor
  • 7880 replies
  • September 28, 2015

You'll need to use an Extension Attribute script to locate the files and report back a simple result like "Installed" or "Not Installed" and then create the Smart Group from that criteria, using the correct result term sent back to the JSS.

While Casper Suite does capture running services, which should include the LaunchDaemon, its not possible to use those as Smart Group criteria.
My bad. It is possible to use Running Services as Smart Group criteria, so it might be possible to look for the existence of the LaunchDaemon, but if you also need to check on the file in /sbin/ then I would still probably use an Extension Attribute for this.

Edit 2: So FWIW, I just out of curiosity tried using the Running Services criteria in a Smart Group. I made the mistake of clicking the ellipses button (...) to choose from a list, and hung my browser up as it valiantly (but hopelessly) tried to load what must have been thousands of possible processes to choose from. Just something to note if you ever decide to use that. Type the process name in manually, don't try to choose it from a list. ;-)


Forum|alt.badge.img+7
  • Contributor
  • 30 replies
  • Answer
  • September 28, 2015

@AVmcclint , we do something similar and the best way I have found is to create an extension attribute for the presence of the file. The Ext Attribute could be similar to this

#!/bin/sh
if [ -e /sbin/filename ]
then 
  echo "<result>True</result>"
else
  echo "<result>False</result>"
fi

Then you build a Smart Group based on that Attribute True or False value.


Forum|alt.badge.img+8
  • Contributor
  • 43 replies
  • September 28, 2015

Your ea script would look like:

#!/bin/bash

[ -f /tmp/file.txt ] && result="Yes" || result="No"

echo "<result>$result</result>"

Flags explained:
-e: Returns true value, if file exists
-f: Return true value, if file exists and regular file
-r: Return true value, if file exists and is readable
-w: Return true value, if file exists and is writable
-x: Return true value, if file exists and is executable
-d: Return true value, if exists and is a directory

Edit: already beaten!


Forum|alt.badge.img+6
  • Contributor
  • 90 replies
  • February 1, 2017

@bkramps Would you be so kind as to elaborate on exactly how to create the Smart Group with this script? I'm pulling my hair out with this!


stevewood
Forum|alt.badge.img+35
  • Employee
  • 1797 replies
  • February 1, 2017

@monaronyc once you've created your Extension Attribute using the script that @bkramps posted, you would create a Smart Group looking for the result you want from that EA.

For example, if your Extension Attribute is called "My File Exists" or whatever, your Smart Group would look for true values in that EA:

Or if you wanted to know about that file missing, you could set the value to False.


Forum|alt.badge.img+6
  • Contributor
  • 90 replies
  • February 1, 2017

@stevewood OH MAN! I totally missed that part! PHOOEY! I've been trying to grasp all this. I think I've got it then. So I created an EA with the script. I then created a Smart Group with the criteria you mentioned. Got that! So now how does that script get pushed so we see the results?


mm2270
Forum|alt.badge.img+16
  • Legendary Contributor
  • 7880 replies
  • February 1, 2017

EA scripts are run during an inventory collection. They are automatically picked up by all managed Macs the next time they submit new inventory and run each time after, updating any results.


stevewood
Forum|alt.badge.img+35
  • Employee
  • 1797 replies
  • February 1, 2017

@monaronyc the script in the EA does not get pushed out. When a machine does an Inventory update (via jamf recon or via your daily inventory update), the EA script will run and populate the data.

If you want to see if it is working, on a machine that has the file open Terminal and sudo jamf recon. Once the recon is done check the Smart Group.


Forum|alt.badge.img+6
  • Contributor
  • 90 replies
  • February 1, 2017

Oh, Perfect! I'll try it now!


Forum|alt.badge.img+6
  • Contributor
  • 90 replies
  • February 2, 2017

Morning guys! I am sorry to say it didn't work. Even with the Recon. EA set up looks like this:

Display name: Search
Description: Yada Yada
Data Type: String
Inventory Display: General
input Type: Script

And the script in the macOS box is:

!/bin/bash

[ -f /Library/LaunchDaemons/com.tanium.taniumclient.plist ] && result='Yes' || result='No'
echo "<result>$result</result>"

Any thoughts?


stevewood
Forum|alt.badge.img+35
  • Employee
  • 1797 replies
  • February 2, 2017

@monaronyc what is the result you are getting in the EA, blank or a yes/no answer? If you enter that script into a .sh file on the computer and run it from the computer manually, not via an EA, what is your result? Have you verified that the plist file is in existence?

I copied what you have above into an EA, placed a file named com.tanium.taniumclient.plist in that file path, and then did a recon on my machine. The EA comes back with a Yes if the file is there and a No if I delete the file and recon again.


Forum|alt.badge.img+6
  • Contributor
  • 90 replies
  • February 2, 2017

@stevewood Yes! Funny you should ask. When I double click the .sh file on my desktop I get a return of Yes in Terminal, file exists. And yes the .plist file is definitely there in the LaunchDaemons folder. When I copy and paste the script into EA, we get nothing after the Recon. The field for this EA in Inventory > General is blank. And i have to tell you... I'm noticing all the other EA's that are there by default are also blank. For instance the ARD fields which we use on a daily basis are all blank. Maybe we have something greater going on here with our environment. Something may need to be reconfigured maybe?


mm2270
Forum|alt.badge.img+16
  • Legendary Contributor
  • 7880 replies
  • February 2, 2017
Maybe we have something greater going on here with our environment.

That's been my thought since yesterday. I don't see any reason why inventory collections are not gathering the info correctly. You may want to get with your Jamf TAM to see what may be going on. I think something is up with your JSS.


etarasula
Forum|alt.badge.img+4
  • Contributor
  • 17 replies
  • May 10, 2021

Super useful post!!!! Thanks a ton!!!


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings