I'm looking into the feasibility of creating a smart group based on the login time of a user on the computer. In other words, something like show me all computers with a login date/time of within the last 12 hours.
I can't seem to find a way to do this and couldn't find any applicable discussion here.
The only way I can see doing this is to create an Extension Attribute that would get the last login value time and drop that into a result formatted so Jamf Pro can use it as a Date formatted EA, and then build your Smart Group from there.
You could use the
last command to do this, but, last has an issue in that the date it stores is not really ideal since it doesn't include all required information. It shows a day, month, date and time, but no year for some inexplicable reason. Generally speaking this isn't a problem, but I can foresee scenarios where results can get a little weird, like just after the start of a new year, because you would have to assume the missing year from the last command is the current one and it may not always be.
A better approach might be to have a persistent login triggered policy (even cached locally so it runs offline) that just captures the date of last login (and maybe the username) on each login into a local file, then have the EA pick up that value later. For example, script for the login policy
#!/bin/bash PLIST="/Library/Preferences/LastLoginValue.plist" sleep 5 loggedInUser=$(stat -f%Su /dev/console) loginTime=$(date +"%Y-%m-%d %H:%M:%S") /usr/bin/defaults write "$PLIST" LastUser "$loggedInUser" /usr/bin/defaults write "$PLIST" LastLoginTime "$loginTime"
Then for the EA script, something like this:
#!/bin/bash PLIST="/Library/Preferences/LastLoginValue.plist" LastLoginTime=$(/usr/bin/defaults read "$PLIST" LastLoginTime 2>/dev/null) if [ ! -z "$LastLoginTime" ]; then result="$LastLoginTime" else result="1970-01-01 00:00:00" fi echo "<result>$result</result>"
Using the above, you'll get results like
The EA should be set up as a Date formatted EA, then you can build Smart Groups that use it with options like
more than x days ago or
less than x days ago
Hope that helps.
Hi @dmcgeels4g. If everything above was set up and the plist is populating, the next thing to look at would be if there has been an inventory collection since it was set up. EAs only get run and thus populate values to a computer record at each inventory collection. So if one hasn't occurred since this was set up, that might be why you're not seeing anything just yet.