Where is application Last Opened data stored?

[james_spencer]

Hi all,

Im looking to make an extension attribute to show when Adobe programs where last used. Does anyone know where the last opened data is stored? I've looked around a lot and can seem to find it anywhere.

Thanks James

[mm2270]

Spotlight stores info on when an application was last launched. It will not, however, show you if the application is still open from the last launching or if it was quit afterwards.

Example using Adobe Acrobat Reader DC

mdls -raw /Applications/Adobe Acrobat Reader DC.app -name kMDItemLastUsedDate

Alternatively, you could enable the Application Usage setting on your Jamf Pro server. It's not great, but it can give you some basic reporting on when applications have been used. But the reporting is manual, not something you can create a Smart Group from that I'm aware of.

[gregneagle]

Note that this data is pretty fragile and gets lost/reset if the files making up the application get replaced; like perhaps during an upgrade from X to X.1, or a re-install. Your user could have launched Foo 1.0 yesterday; today the app gets updated to Foo 1.1 and now the Spotlight metadata shows it has never been launched.

[mm2270]

@gregneagle You make a good point. I've also seen this info be transient at times. Sometimes Spotlight reports a null value for an app that I know was launched in the past. In addition to the examples you mentioned, I've also seen cases where if the Spotlight data is very old for an app or file it just doesn't contain the last opened value at all.

Given this, do you know of a better/more reliable method of getting last opened timestamps? I'm not aware of anything else built into the OS, but that doesn't mean it doesn't exist. Maybe there's a better way?

[james_spencer]

Thanks for the help guys. I have made an extension attribute using the below

!/bin/sh

if [ -d /Applications/Adobe Photoshop CS6/ ]; then LastOpened=mdls /Applications/Adobe Photoshop CS6/Adobe Photoshop CS6.app/ -name kMDItemLastUsedDate | awk '{print $3, $4}' echo "<result>$LastOpened</result>"
else echo "<result>Not installed</result>"
fi

exit 0

[gregneagle]

"Given this, do you know of a better/more reliable method of getting last opened timestamps?"

I do, but not one that ships with the OS or with Jamf.

[mm2270]

I do, but not one that ships with the OS or with Jamf.

@gregneagle I take that to mean something included in Munki, or an adjunct product that it can use. Is that the case? I'm curious to know what it is, just for own education.

Of course, as I mentioned, Jamf does have their own application usage tracking system. It's far from perfect, and unfortunately reporting anything out of the data is... difficult. But, there is something there.