Update Inventory Policy

[ThijsX]

Hi,

We have a while a policy running that Updates Inventory, at every "recurring check-in" with execution frequency "ongoing" scoped to "all computers".

JSS is giving us the message "Policies that update inventory on all computers cannot be set to ongoing frequency at recurring check-in."

Our clients have a configured check-in every 30 minutes, we dont have performance issues, but what is the best way to retrieve every 30 minutes a inventory check-in

Thanks!

[mm2270 · Accepted solution]

Can I ask why you really need inventory collection every 30 minutes? Jamf purposely disables the ability to scope inventory collection on recurring check in on all managed devices because it will cause performance problems that will bite you later, even if it doesn't do it right away. Basically, don't do it. There are a lot of other times when inventory collection might happen, like with other policies you have running, but scoped to smaller groups of systems.

Also, keep in mind comparing "check-in" every 30 minutes with "inventory collection" every 30 minutes is an invalid comparison. There is MUCH more overhead with inventory collection than just a check-in. That's why Jamf has made it impossible to do what you're trying to do.

[Look · Accepted solution]

I inventory once a day, but only on workstations with an update more than a day ago. Keeps things current but skips if another policy has already done an inventory update.
I concur with all the above, when our instance was originally setup almost all policies had inventory collection turned on, over time things really slowed down to a crawl, I think pretty much every inventory collection ends up stored somewhere in the database, or at least until the next log flush.

[millersc]

What version are you using?

I was able to make a test policy like yours in my 9.96 with no issues. Albeit I only scoped to my own workstation, the Maintenance tab was configured for 30 min.

I have to ask, how big is your install base? If I did this with my 5000k + devices, it would crush anything it was on. We're on a week inventory, unless software is installed, which then does another inventory.

[mm2270 · Accepted solution]

Can I ask why you really need inventory collection every 30 minutes? Jamf purposely disables the ability to scope inventory collection on recurring check in on all managed devices because it will cause performance problems that will bite you later, even if it doesn't do it right away. Basically, don't do it. There are a lot of other times when inventory collection might happen, like with other policies you have running, but scoped to smaller groups of systems.

Also, keep in mind comparing "check-in" every 30 minutes with "inventory collection" every 30 minutes is an invalid comparison. There is MUCH more overhead with inventory collection than just a check-in. That's why Jamf has made it impossible to do what you're trying to do.

[jared_f]

I agree with @mm2270, an inventory update every check-in would overload your server and you will see the impact of it as time goes on. I also take an inventory update once a week and post app installations.

[Look · Accepted solution]

I inventory once a day, but only on workstations with an update more than a day ago. Keeps things current but skips if another policy has already done an inventory update.
I concur with all the above, when our instance was originally setup almost all policies had inventory collection turned on, over time things really slowed down to a crawl, I think pretty much every inventory collection ends up stored somewhere in the database, or at least until the next log flush.

[emily · Accepted solution]

You'll need some very aggressive log flushing if you're collecting that much data that regularly. Jamf is likely trying to help you from blowing up your db. :)

[ThijsX]

Hi all,

Thank you all for your advise :) It is very clear now this is not a good way of inventory collection!

Greetings,

Thijs Xhaflaire

[mcs-jamf]

Hey Xhaflaire,

Are you willing to share how you made your inventory update every 30 mins? I need to conduct an inventory update at 8:30am and 3:30pm each day due to students heading offsite with a VPN profile.

Was this done via the API, or did you manage to make a scheduled task in the server?

Any help would be greatly appreciated.

Aaron

[jared_f]

@mcs-jamf Have you disabled students ability to add manual VPN configurations and install configuration profiles manually? Also, is your JSS available off site?

We don't allow VPNs as it is a HIPPA concern as we don't know where the traffic is going. I have a smart group casted and alerts me if a user installs a VPN app. That VPN group is scoped to a configuration profile that locks down the iPad.