Time Machine Extension Attribute (Compatible with 10.10)

[m_higgins]

Has anyone managed to successfully write a script for this?

[lisacherie]

Not sure what you are wanting to report on, take a look at the options availabile in the ```
tmutil
``` command.

[m_higgins]

I am trying to get a script together that shows when the last successful backup was taken. I have found a few on here that work with Mavericks, but none that work with Yosemite

[m_higgins]

Like this one for example https://jamfnation.jamfsoftware.com/viewProductFile.html?id=133&fid=667

[lisacherie]

You could try using tmutil latestbackup to determine the path, then look at the timestamp for the file.

[m_higgins]

Im sure someone can easily whip up something but I am having no luck at the moment

[stoneacheck]

@m.higgins,

Yeah, it looks like tmutil latest backup is what you want:

#!/bin/sh
backupDate="$(tmutil latestbackup)"
trimmedbackupDate="${backupDate: -17}"
Echo "<result>$trimmedbackupDate</result>"

Seems to do the trick. https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/tmutil.8.html there's the man page and it references that latest backup command, and then I just passed the output into a variable called backupDate which then gets trimmed and echoed with the result tags. If you set the EA as a date, that should be right format, and similar to how the old EA grabbed it.

Sometimes luck is just finding a ton of well written stack overflow answers :) I had no idea how to approach this either but I like problem solving and had a bit of time today!

I tested this on my mavericks machine and it worked great, it did spit it out a weird error on my buddy's Yosemite mbp, "unable to locate machine directory host" but i had him look in the man pages and the command is still there, so maybe it's just his machine? Try it out!

If you want to keep the legacy stuff in the old script you could just replace the contents of line 35 at the bottom and that should work?

[Chris_Hafner]

I haven't dug into this yet... however this command is only producing results when the TM Volume is connected on the single machine I checked it on. I'll put this on my list of things to dig into this weekend.

[stoneacheck]

Hmm yeah I'm backing up to a Synology over network, could have explained my buddy's error if the volume isn't mounted.

[m_higgins]

Thanks for the effort with this. Much appreciated

[m_higgins]

I wonder if @Chris_Hafner has had any joy with this

[Chris_Hafner]

Well... sort of. Unfortunately I've run into a time crunch and this has ended up far lower on my priority list. Regardless, I've been working from the following reference scripts and it's been pointing me in some interesting directiongs. Check these out.

http://www.fixitscripts.com/problems/script-check-time-machine-backups-and-report-how-long-since-last-good-backup-on-client-daily-report

I can verify that these work on 10.10 without needing the external volume attached. I just haven't made an EA out of it yet, though some of you could probably use it as is... again this IS NOT MY WORK!

[Chris_Hafner]

A little more digging this morning and the folks I see successfully doing this are doing direct syslog searches. Apples developer pages are relatively blank on the subject and all of my old tricks seems to fail. This is very very strange. The system certainly knows when it's last backup was but I'm having trouble locating where that info is stored.

EDIT: In addition others seem to be running tmutil latestsbackup when the backup volume is connected and then storing that result in a plist for later extract. There has to be a better solution here.

[Chris_Hafner]

eh... Apparently I've forgotten how to properly cruise the forums for the answer. It looks like our answer is already part of the existing EAs from Chad Nielsen (found here: https://jamfnation.jamfsoftware.com/viewProductFile.html?id=133&fid=667)
There's the original thread form which the EA was originally discussed. https://jamfnation.jamfsoftware.com/discussion.html?id=8814

Regardless, the following section of the EA mentioned will give the desired result.

# Check the OS, and then check the values in the appropriate corresponding files. # Check to see if autobackup is enabled. autoBackupEnabled=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/AutoBackup/{print $3}' | tr -d ";") # A value of 1 signifies that Time Machine is on, a value of 0 is off. if [ "$autoBackupEnabled" = "1" ]; then #lastBackupTime=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/SnapshotDates/{getline; print substr($0,9)}' | sed 's/^ *//g' | tr -d '"') lastBackupTime=$(defaults read /Library/Preferences/com.apple.TimeMachine Destinations | sed -n '/SnapshotDates/,$p' | grep -e '[0-9]' | awk -F '"' '{print $2}' | sort | tail -n1 | cut -d" " -f1,2) else lastBackupTime="Not enabled." fi # Report the Time Machine status to the JSS. echo "<result>$lastBackupTime</result>"

In the mean time I've simply modified the EA (poorly) so that it's OS check would pass Yosemite sw_vers check result of "10.1" given the current awk requirements. I only changed the OS check from:

if [ "$OS" = "10.9" ]; then

to

if [ "$OS" = "10.9" ]||[ "$OS" = "10.1" ]; then

This means that my present EA looks like this.

#!/bin/sh # Gather Time Machine Last Backup Status for JSS # Written by Chad Nielsen # Forget Computers, Get Creative! # Last Modified on October 25th, 2013. # Updated by Rémy Schwarz on January 22th, 2014 / Habegger AG # Version History # 1.0 - original attribute by JAMF Software supporting OS X 10.8 and lower. # 1.1 - added ability to check status in OS X 10.9 Mavericks. # 1.2 - Optimized the Command to find the latest TimeMachine-Backup-date on OS X 10.9 Mavericks. # 1.3 - Stolen from Chad Nielsen and shamelessly modified to report lastbackup from 10.10 Yosemite. I'm darned sure there's a better way to handle the version check but I had very little time. Sorry Chad # Determine the OS Version OS=$(sw_vers | awk '/ProductVersion/{print substr($2,1,4)}') # Check the OS, and then check the values in the appropriate corresponding files. if [ "$OS" = "10.9" ]||[ "$OS" = "10.1" ]; then # Check to see if autobackup is enabled. autoBackupEnabled=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/AutoBackup/{print $3}' | tr -d ";") # A value of 1 signifies that Time Machine is on, a value of 0 is off. if [ "$autoBackupEnabled" = "1" ]; then #lastBackupTime=$(defaults read /Library/Preferences/com.apple.TimeMachine | awk '/SnapshotDates/{getline; print substr($0,9)}' | sed 's/^ *//g' | tr -d '"') lastBackupTime=$(defaults read /Library/Preferences/com.apple.TimeMachine Destinations | sed -n '/SnapshotDates/,$p' | grep -e '[0-9]' | awk -F '"' '{print $2}' | sort | tail -n1 | cut -d" " -f1,2) else lastBackupTime="Not enabled." fi else # This is the traditional attribute code provided by JAMF, modified slightly. if [ -f /private/var/db/.TimeMachine.Results.plist ]; then lastBackupTime=$(defaults read /private/var/db/.TimeMachine.Results "BACKUP_COMPLETED_DATE") else lastBackupTime="Not enabled." fi fi # Report the Time Machine status to the JSS. echo "<result>$lastBackupTime</result>"

So, while that works there are significant problems with this modification. The biggest being that this would automatically pass 10.1, or any future versions of the OS thats 10.11, 10.12, etc... Unfortunately I have to remember how to use regular expressions and I've never been that proficient here anyways. @themacallan or @it_services any thoughts?

[themacallan · Accepted solution]

Hi Chris!

I updated the script for Yosemite that will not need to be modified again until Apple changes how Time Machine works without telling anyone, as is tradition. I've zipped a copy as an XML (use link below) and it is ready for upload to your JSS, replacing any previous "Time Machine - Last Backup Date" attributes.

http://tinyurl.com/kmuzw6m

Cheers!
Chad Nielsen
Forget Computers

[mm2270]

@Chris_Hafner

Change this line in the script:

OS=$(sw_vers | awk '/ProductVersion/{print substr($2,1,4)}')

to look like this instead:

OS=$(sw_vers -productVersion | cut -d. -f2)

Then change the line you currently have that looks like:

if [ "$OS" = "10.9" ]||[ "$OS" = "10.1" ]; then

to:

if [ "$OS" -ge "9" ]; then

This will grab the sub OS version, like "9" for 10.9.x, or "10" for 10.10.x, etc and only run your command if its 9 or higher. I assume that's what your concern was? If not, can you clarify what condition you want to check for?

[m_higgins]

This is excellent! Many thanks for this! I works a dream! Thanks @themacallan

[Chris_Hafner]

Spectacular on the both of you! @mm2270 and @themacallan This works beautifully.

Mike, that is specifically what I was worried about. Chad's new EA uses a similar methodology, except

OS=$(sw_vers | awk '/ProductVersion/{print substr($2,1,5)}' | tr -d ".")

and

if [ "$OS" -ge "109" ]; then

[creedofman]

@themacallan Is there any way you could update the link you posted above? This looks like the solution that I need, but I'm just getting a 404 on that link.

Thanks for any help you can give!

[themacallan]

Heyo.

@aganahl This should do the trick for you.

Time Machine - Last Backup Date

Cheers,
Chad

[creedofman]

@themacallan Thanks!

[jltrenary]

I was looking for a "Time Machine - Last Backup Date" EA for 10.11 and 10.12. If the script Chad wrote works well with 10.11 and 10.12, I'd like very much to get a copy. The link from May 26 is no longer valid. Is the script posted anywhere else? I've been unsuccessful in finding it.

[themacallan]

Hey @jltrenary - this should do you right. I'm in a new job that no longer uses Time Machine (thank goodness), but I took a quick look at the code above from 2014 and updated it.

#!/bin/bash


# Check Time Machine Backups
# Written by Chad Nielsen

###################################[ VARIABLE DEFINITIONS ]##################################

dateBackup="No Time Machine Backups"
macOS=$(sw_vers | awk '/ProductVersion/{print substr($2,1,5)}' | tr -d ".")
pathPlistNew="/Library/Preferences/com.apple.TimeMachine.plist"
pathPlistOld="/private/var/db/.TimeMachine.Results.plist"

######################[ SCRIPT BEGINS - DO NOT MODIFY BELOW THIS LINE ]######################


function main {
    # Check the OS to determine where to look.
    if [ "$macOS" -ge "109" ]; then
        # If Auto Backup is enabled, get the Time Machine last backup date.
        checkAutoBackup=$(defaults read "$pathPlistNew" | awk '/AutoBackup/{print $3}' 
        | tr -d ";")
        if [ "$checkAutoBackup" = "1" ]; then
            dateBackup=$(defaults read "$pathPlistNew" Destinations | 
            sed -n '/SnapshotDates/,$p' | grep -e '[0-9]' | awk -F '"' '{print $2}' | sort 
            | tail -n1 | cut -d" " -f1,2)
            if [ "$dateBackup" = "" ]; then
                dateBackup="Initial Backup Incomplete"
            fi
        fi
    else
        if [ -e "$pathPlistOld" ]; then
            dateBackup=$(defaults read "$pathPlistOld" "BACKUP_COMPLETED_DATE")
            if [ "$dateBackup" = "" ]; then
                dateBackup="Initial Backup Incomplete"
            fi
        fi
    fi
    # Report the result to the JSS.
    echo "<result>$dateBackup</result>"
}

######################################[ FUNCTION CALLS ]##################################### 

main

Cheers,
Chad

[CJeffery]

Thanks Chad.

How do we check the results, where does it post them?

[jonathanwilson]

I learned this the hard way, so I'm sharing it here: you need to use the plist for this (what Chad's script does) instead of tmutil, because tmutil does a live check of the backup database. If, for example, the computer backs up to an external drive, and that drive is not attached and mounted when recon runs, you won't get a useful result. The plist, however, will remain static on the computer and can be referenced each time recon runs without a problem.

[RJH]

Thanks Chad. I've just tested this and it appears that the date/time stored in the plist file for High Sierra for last TM backup is in GMT (0). Are other people also seeing this?
Just means I have to adjust for local time, which Im sure I can find a way to do via script (+11 hours). Would be great if it was already local time though, as it would also then be out by an hour when daylight savings time finishes and reverts back to AEDT.

[wildfrog]

@rhill The reason you're seeing this is because the script is pulling the last completed backup date from the SnapshotDates values in com.apple.TimeMachine.plist - which writes those dates in Zulu Time (GMT). Personally, I wish it recorded the value in epoch time. I don't so much want to know when the last completed backup is as how many days have elapsed since the last backup has been completed. Since epoch time is independent of time zone, it makes those calculations much easier. So, like you, I'm left to figure out a conversion to get me the info I need. But that's the why, anyway.