System Diagnostic Logs from your Users

[Andrina]

Thought I'd share this, I've set this up as a Self Service item, it relies on the built-in sysdiagnose tool, and then puts together a nice user-friendly e-mail so they can submit their woes to us.

As a side note, the icon I chose is a stack of *actual* logs... you know, like portions of trees... apparently this was somewhat entertaining to some folks here....

Enjoy!

#!/bin/bash

# Set Variables
# Who's the current console user?
LOGGEDIN=`who | grep console | awk '{print $1}'`
# What's the default mail client for the logged in user?
DEFAULTMAIL=`defaults read /Users/$LOGGEDIN/Library/Preferences/com.apple.LaunchServices.plist | perl -e 'while(<>) {push @lines, $_; m~mailto~ and last} $_ = $lines[-2]; s~[^"]+"~~;s~";~~;print'`
# Get the Computer Name
COMPUTER=`hostname`
# The file that sysdiagnose created to add as an attachment
FILE=`ls -ltr /var/tmp | tail -1 | awk '{print $9}'`
# Name of the disk the OS is booted off of for AppleScript to be happy...
BOOTDISK=`diskutil info / | grep "Volume Name" | cut -c 30-50`
# Path on local machine to CocoaDialog
CD="/Path/To/CocoaDialog.app/Contents/MacOS/CocoaDialog"

# Simple expect to get the return for sysdiagnose to run
expect <<- DONE
  set timeout -1
  spawn sysdiagnose

  # Look for  prompt
  expect "*?ontinue*"
  # send blank line (
) to make sure we get back to gui
  send -- "
"
  expect eof
DONE

# Based on what default mail client the user is using, put everything together in a nice mail for them
if [ "$DEFAULTMAIL" == "com.apple.mail" ];
then

echo "tell application "Mail"
    set theContent to ("Included are System Diagnostic logs from the computer ${COMPUTER}. \r \r Please include any details about what was going on on your machine that caused you to send us this information. \r \r Affected Application: \r Is the problem reproducable: \r Steps to reproduce: \r Expected Results: \r Actual Results: \r \r ")
    set theEmail to make new outgoing message with properties {visible:true, subject:"System Diagnostic Logs from ${COMPUTER}", content:theContent}
    tell theEmail
        make new recipient at end of to recipients with properties {address:"administrator@example.com"}
        make new attachment with properties {file name:"$BOOTDISK:var:tmp:$FILE" as alias} at after last paragraph            
        end tell
end tell" | osascript

elif [ "$DEFAULTMAIL" == "com.microsoft.outlook" ];
then

echo "tell application "Microsoft Outlook"
    set theContent to ("Included are System Diagnostic logs from the computer ${COMPUTER}. <br><br> Please include any details about what was going on on your machine that caused you to send us this information. <br><br> Affected Application: <br> Is the problem reproducable: <br> Steps to reproduce: <br> Expected Results: <br> Actual Results: <br><br> ")
    set theAttachment to file "$BOOTDISK:var:tmp:$FILE" as alias
    set newMessage to make new outgoing message with properties {subject:"System Diagnostic Logs from ${COMPUTER}", content:theContent}
    make new recipient at newMessage with properties {email address:{name:"Administrator", address:"administrator@example.com"}}
    make new attachment at newMessage with properties {file:"$BOOTDISK:var:tmp:$FILE" as alias}
    open newMessage
end tell" | osascript

# Not using Mail or Outlook? Here's the file and what to do with it...
else
$CD ok-msgbox --text "No Acceptable Mail Client Found" 
--informative-text "It appears that neither Apple Mail or Microsoft Outlook are being used as your default mail applications. If you wish to send the diagnostic report please send the resulting file to administrator@example.com" 
--no-newline --float
logger "No suitable mail client found"

exit 0
fi

[rtrouton]

Nice! Thanks for sharing this.

[tkimpton]

That's great but please can you tell me where you put path to CocoaDialog what is it?

Thanks

[bentoms]

@tkimpton it goes wherever... Mine's in an /etc or /var directory to hide it.

/Applications or /Utilities would work too.

[jpmaynar]

I have this setup but with some issues. Any thoughts on the below?

When Apple Mail is the default client a new email message opens, but the file does not automatically attach to the new message. Policy status is complete

When Outlook is the default client a new message window is NOT opened and I get the below error message in the policy log and the policy Status is failed.

.......
.......
Gathering logs... Output available at '/var/tmp/sysdiagnose_2013.10.30_12-18-34-EDT.tar.gz'. 713:802: execution error: Microsoft Outlook got an error: Error while saving the changed record property. (-2700)

[tkimpton]

need some clarification please.

CD="/etc/"

test.sh: line 56: /etc/: is a directory

[tkimpton]

decided to use this instead

MSG="It appears that neither Apple Mail or Microsoft Outlook are being used as your default mail applications. If you wish to send the diagnostic report please send the resulting file to administrator@example.com"

sudo /Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper 
-windowType utility -title "Send Diagnostics" -description "$MSG" -button1 "OK" 
-icon /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertCautionIcon.icns -iconSize 96

[stevewood]

@tkimpton when Andrina put this line in her code:

CD="/Path/To/CocoaDialog.app/Contents/MacOS/CocoaDialog"

She was simply saying to put the path to your copy on the systems. Like @bentoms mentioned above, his path is in either /etc or /var so that it is hidden from the users.

In my case, I have a directory in /private/var that holds several different folders, along with two utilities that I use: dockutil and cocoaDialog. So, for example, mine goes in /private/var/inte/bin and that means my path to cocoaDialog (CD variable in Andrina's script) looks like this:

CD="/private/var/inte/bin/cocoaDialog.app/Contents/MacOS/CocoaDialog"

And when I call it, it generally looks something like this:

bubble=`$CD bubble --title "$cdTitle" $cdTimeout --text "$cdText" --icon-file $cdIcon`

Make sense?

[tkimpton]

Thanks Steve, i didnt realise it was an actual app!

[stevewood]

Many of us are using cocoaDialog instead of jamfHelper. Here's a link to the GitHub page:

http://mstratman.github.io/cocoadialog/

[bentoms]

fwiw.. mine's in /usr/local/bin

[lwindram]

@jpmaynar][/url - what resolution did you reach with the Outlook execution error? I'm at the same point... If I comment out the

make new attachment at newMessage with properties {file:"$BOOTDISK:var:tmp:$FILE" as alias}

line, the policy executes as expected. Minus the logs, of course.

[jpmaynar]

@lwindram I have not resolved this yet.

[ImAMacGuy]

just as an FYI - it seems to stall out if you don't have a mail client open. It launches the default, but it never opens the new message dialog. Also, it works even if you don't have cocoadialog installed, course, if it can't find the default client, not sure what will happen :)

[ImAMacGuy]

@andrinak - Thank you!

@ everybody - I modified it to not have a specific point of contact, since it will be the deskside / remote technicians that ultimately support the users. I have a question though, is there any guides I can point them to for how to decipher the information in those logs? The technicians have varying degrees of Mac IT knowledge and could probably use some extra help figuring it out.

[kaci_weirich]

Has anyone had luck where Google Chrome as the default mail client?

[p644a1]

Has anyone got this script to run, I am get many errors in the data gather sections. Still can't get the email via outlook working .

[jhbush]

@p644a1 just tested this script again under 14.4.1 and it seems to work again. Thanks again to @Andrina for providing such a useful script.

[ImAMacGuy]

It doesn't seem to attach the sys diagnose file, it creates it just fine, but it only attached a .DS_Store file or some other random file from that folder...

also, i've been trying to find out how to add a bcc to the email messages for both mail and outlook, any ideas?

[jarednichols]

Here's one I made years back:

#!/bin/sh

################################################################################################
##### Filename: submitlogs.sh                                                              #####
##### Author:  Jared F. Nichols                                                            #####
##### Purpose: Submit logs to a dropbox share for further analysis.                        #####
################################################################################################
dateformat=`date +"%Y-%m-%d"`
hostname=`jamf getComputerName | sed -e 's/<computer_name>//' -e 's/</computer_name>//'`

user=`ls -l /dev/console | cut -d " " -f 4`
filename="$dateformat-$hostname.zip"

jamf mount -server LLCasper01 -share ClientLogs -type afp
zip -r /Volumes/ClientLogs/$filename /var/log/ /Library/Logs/ /Users/$user/Library/Logs
umount -f /Volumes/ClientLogs

exit 0

It requires you to have a share on your server that's guest writable. A write-only "Dropbox" suffices. I made a Self Service policy for it and help desk folks could ask the user to fire it off and we could sift through the logs pretty easily.

[ClassicII]

@jwojda

Having the same issue and trying to figure it out. It seems to just grab the first file in the tmp directory which is .DS_Store

Try this though. leave the log file there and then run the script again. It will actually attach the log but the 1st one not the 2nd one you really want. Its almost like the file its looking for is not there when it tries to grab it so it just grabs any file it can.

[jhbush]

Attached is the version I've used that works. I made a few edits in the variables.The only problem I have is the attachment is too large and our mail servers reject it.```

!/bin/bash

############################################################

Created By: Andrina Kelly, andrina.kelly@bellmedia.ca, Ext 4995

Creation Date: April 2013

Last modified: July 16th, 2014

Brief Description: Gather diagnostic logs and submit to support

############################################################

LOGGEDIN=who | grep console | awk '{print $1}'
DEFAULTMAIL=defaults read /Users/$LOGGEDIN/Library/Preferences/com.apple.LaunchServices.plist | perl -e 'while(<>) {push @lines, $; m~mailto~ and last} $ = $lines[-2]; s~[^"]+";s~";;print'
COMPUTER=hostname
FILE=ls -ltr /var/tmp | tail -1 | awk '{print $9}'
BOOTDISK=diskutil info / | grep "Volume Name" | cut -c 30-50
CD="/usr/local/bin/cocoaDialog.app/Contents/MacOS/CocoaDialog"

expect <<- DONE set timeout -1 spawn sysdiagnose

# Look for prompt expect "?ontinue" # send blank line ( ) to make sure we get back to gui send -- " " expect eof
DONE

if [ "$DEFAULTMAIL" == "com.apple.mail" ];
then

echo "tell application "Mail" set theContent to ("Included are System Diagnostic logs from the computer ${COMPUTER}. Please include any details about what was going on on your machine that caused you to send us this information. Affected Application: Is the problem reproducable: Steps to reproduce: Expected Results: Actual Results: ") set theEmail to make new outgoing message with properties {visible:true, subject:"System Diagnostic Logs from ${COMPUTER}", content:theContent} tell theEmail make new recipient at end of to recipients with properties {address:"support@yourcompany.com"} make new attachment with properties {file name:"$BOOTDISK:var:tmp:$FILE" as alias} at after last paragraph end tell
end tell" | osascript

elif [ "$DEFAULTMAIL" == "com.microsoft.outlook" ];
then

echo "tell application "Microsoft Outlook" set theContent to ("Included are System Diagnostic logs from the computer ${COMPUTER}. <br><br> Please include any details about what was going on on your machine that caused you to send us this information. <br><br> Affected Application: <br> Is the problem reproducable: <br> Steps to reproduce: <br> Expected Results: <br> Actual Results: <br><br> ") set theAttachment to file "$BOOTDISK:var:tmp:$FILE" as alias set newMessage to make new outgoing message with properties {subject:"System Diagnostic Logs from ${COMPUTER}", content:theContent} make new recipient at newMessage with properties {email address:{name:"support", address:"support@yourcompany.com"}} make new attachment at newMessage with properties {file:"$BOOTDISK:var:tmp:$FILE" as alias} open newMessage
end tell" | osascript

else
$CD ok-msgbox --text "No Acceptable Mail Client Found"
--informative-text "It appears that neither Apple Mail or Microsoft Outlook are being used as your default mail applications. If you wish to send the diagnostic report to support please send the resulting file to support@yourcompany.com"
--no-newline --float
logger "No suitable mail client found"

exit 0
fi
```

[ClassicII]

@jhbush1973

Thanks for posting that but it seems do be doing the same thing if no diag log is in /var/tmp it will select .ds_store as the attachment. Then again that code in yours is the same.

[jhbush]

@ClassicII yeah I noticed that. I should have tested more before posting. It looks like if you can figure out how to search for the newest file with sys in the name things should work.

[ClassicII]

Ok looks like the problem is the variable is run at the beginning and is set before the sys diagnose even runs.

So if you run ls -ltr /var/tmp | tail -1 | awk '{print $9}' it will look in that folder and the only file in that folder is .ds_store and will set that as the variable.

But if you move the variable statement after sys diag runs it works perfectly because the file is there when it sets the variable

so the middle of the script would look something like this.

spawn sysdiagnose

# Look for prompt expect "?ontinue" # send blank line ( ) to make sure we get back to gui send -- " " expect eof
DONE

# The file that sysdiagnose created to add as an attachment
FILE=ls -ltr /var/tmp | tail -1 | awk '{print $9}'

echo "tell application "Microsoft Outlook"

I am going to say that the scripting experts have a better way but this does work for now!

[franton]

That's exactly what i've done this morning!

However while this script prepares everything nicely, it doesn't auto send it. Is this a restriction in Office 2011 SP3?

[mostlikelee]

Oldie but goodie! In case you want to upload to an smb file share instead:

computername=`scutil --get ComputerName`
logfile=`ls /tmp/ | grep sysdiagnose`

mkdir /tmp/SHARENAME 2>&1
mount -t smbfs //USERNAME:PASSWORD@SERVERNAME/SHARENAME /tmp/SHARENAME

if [ ! -d /tmp/SHARENAME/${computername} ]; then
    mkdir /tmp/SHARENAME/${computername}
fi

cp /tmp/${logfile} /tmp/SHARENAME/${computername}/

rm /tmp/${logfile}

umount -t smbfs /tmp/SHARENAME

[Shoesmithlc]

Andrina: thank you very much for sharing. found your "Getting Users to Do Your Job (Without Them Knowning It) YouTube video.

[brandon_white]

Hi @jarednichols , I've been using your script above to collect client logs onto an AFP dropbox, with great success -- thanks for this. But, the "jamf mount" command fails for me since I upgraded my JSS to v9.9 -- that's the only change I made at the time. I can still mount the share manually in the Finder just as I'd expect, I just can't "jamf mount" it successfully. The script returns:

Mounting 172.20.1.8
Could not mount distribution point "172.20.1.8"
There was an error mounting the file server at 172.20.1.8. Will attempt again.
Mounting to /Volumes/ClientLogs...
Could not mount distribution point "172.20.1.8"
There was an error mounting the file server at 172.20.1.8. Giving up.
zip I/O error: No such file or directory
zip error: Could not create output file (/Volumes/ClientLogs/2016-04-08-bhwhite.zip)
umount: /Volumes/ClientLogs: not currently mounted

Do you have any advice? Thanks in advance for any suggestions.

[alexissantina]

@brandon.white and I were able to fix this in our organization by replacing the JAMF mount command with OSX's native mount_afp command:

#!/bin/sh

# Mount the drive 
sudo mkdir /Volumes/ClientLogs
mount_afp "afp://172.20.1.8/ClientLogs" /Volumes/ClientLogs

# Send zip file
dateformat=`date +"%Y-%m-%d"`
hostname=`jamf getComputerName | sed -e 's/<computer_name>//' -e 's/</computer_name>//'`

user=`ls -l /dev/console | cut -d " " -f 4`
filename="$dateformat-$hostname.zip"

zip -r /Volumes/ClientLogs/$filename /var/log/ /Library/Logs/ /Users/$user/Library/Logs
umount -f /Volumes/ClientLogs

exit 0

[rderewianko]

We do something a bit different with the diagnostic output.
We upload them to the JSS in attachments, and then we can grab it from there.
More Info

[Nmangal]

Sorry to bug you on this old thread...but has anyone had luck to attach multiple attachments in a new message in Outlook by command line?