Skip to main content

I am having a little brain fart here, but I'm sure it's simple. When I run this jamf policy using the event flag from Terminal, it runs just fine (probably because it prompts for my credentials). But if I try to run it from self service, I get an error that a Terminal is required for the password.


Script:


#!/bin/bash

#Find current logged in user
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name 😕 && ! /loginwindow/ { print $3 }' )

#Runs SysDiagnose as Current User
su $loggedInUser -c "sudo /usr/bin/sysdiagnose -u -f ~/Desktop/"

Error:



I want users to have the capability to run SysDiagnose from Self Service, without it prompting for a password.

Nevermind, I figured it out...


New Script:


 


#!/bin/bash

#Find current logged in user
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name 😕 && ! /loginwindow/ { print $3 }' )

#Runs SysDiagnose and places ZIP on User's Desktop
/usr/bin/sysdiagnose -u -f /Users/$loggedInUser/Desktop

 

Nevermind, I figured it out...


New Script:


 


#!/bin/bash

#Find current logged in user
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name 😕 && ! /loginwindow/ { print $3 }' )

#Runs SysDiagnose and places ZIP on User's Desktop
/usr/bin/sysdiagnose -u -f /Users/$loggedInUser/Desktop

 


Thanks for posting this! I made a modification to instead store the sysdiagnose data in /usr/local/Management, a folder I create in a lot of my scripts to be a storage location. A follow up script can handle copying the file to a Mac's Jamf Pro inventory where I can download it when needed. For some things, I don't want to disturb the user.


#!/bin/bash

# Location of the Management folder
managementFolder="/usr/local/Management/"

# Create Management folder if it doesn't exist
if ! [ -d "$managementFolder" ]; then
echo "Creating Management folder"
mkdir "$managementFolder"
else
echo "Managefolder exists..."
fi

#Runs SysDiagnose and places ZIP in the Management folder
echo "Running sysdianose. Saving to $managementFolder."
/usr/bin/sysdiagnose -u -f ${managementFolder}

Thanks for posting this! I made a modification to instead store the sysdiagnose data in /usr/local/Management, a folder I create in a lot of my scripts to be a storage location. A follow up script can handle copying the file to a Mac's Jamf Pro inventory where I can download it when needed. For some things, I don't want to disturb the user.


#!/bin/bash

# Location of the Management folder
managementFolder="/usr/local/Management/"

# Create Management folder if it doesn't exist
if ! [ -d "$managementFolder" ]; then
echo "Creating Management folder"
mkdir "$managementFolder"
else
echo "Managefolder exists..."
fi

#Runs SysDiagnose and places ZIP in the Management folder
echo "Running sysdianose. Saving to $managementFolder."
/usr/bin/sysdiagnose -u -f ${managementFolder}

Thanks for the insight! How would one download the file from the Jamf Pro inventory? I typically am ok with the sysdiagnose going to the desktop, as I would only be doing that while working with the user. But it's interesting to figure out how to download the file later.

My policy uses the script that I posted above with the "Before" priority and this script that I got from Github with the "After" priority. I modified the script from https://github.com/kc9wwh/logCollection/blob/master/logCollection.sh. It's below. I changed it to use a bearer token and I changed the variables to work better with what I needed. I created a function called "jamfAPI_auth" that I use in every script that uses the Jamf API.


#!/bin/bash

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# Copyright (c) 2020 Jamf. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of the Jamf nor the names of its contributors may be
# used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# This script was designed to be used in a Self Service policy to allow the facilitation
# or log collection by the end-user and upload the logs to the device record in Jamf Pro
# as an attachment.
#
# REQUIREMENTS:
# - Jamf Pro
# - macOS Clients running version 10.13 or later
#
#
# For more information, visit https://github.com/kc9wwh/logCollection
#
# Written by: Joshua Roskos | Jamf
# Modified 2024-08-21 Howie Isaacks
# Added Jamf auth function, modified variables
#
# Revision History
# 2020-12-01: Added support for macOS Big Sur
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

## Variables
logFiles="$4"

## System Variables
mySerial=$( system_profiler SPHardwareDataType | grep Serial | awk '{print $NF}' )
currentUser=$( stat -f%Su /dev/console )
compHostName=$( scutil --get LocalHostName )
timeStamp=$( date '+%Y-%m-%d-%H-%M-%S' )
osMajor=$(/usr/bin/sw_vers -productVersion | awk -F . '{print $1}')
osMinor=$(/usr/bin/sw_vers -productVersion | awk -F . '{print $2}')

## Log Collection
fileName=$compHostName-$currentUser-$timeStamp.zip
zip -r /private/tmp/$fileName $logFiles

function jamfAPI_auth() {
# API login
jamfProURL="https://yourcompany.jamfcloud.com"
username="apiuser"
password="SuperDuperSecretPassword!"

# request auth token
authToken=$( /usr/bin/curl \\
--request POST \\
--silent \\
--url "$jamfProURL/api/v1/auth/token" \\
--user "$username:$password" )

# parse auth token
token=$( /usr/bin/plutil \\
-extract token raw - <<< "$authToken" )

tokenExpiration=$( /usr/bin/plutil \\
-extract expires raw - <<< "$authToken" )

localTokenExpirationEpoch=$( TZ=GMT /bin/date -j \\
-f "%Y-%m-%dT%T" "$tokenExpiration" \\
+"%s" 2> /dev/null )
}

jamfAPI_auth
echo "$token"

## Upload Log File
if [[ "$osMajor" -ge 11 ]]; then
jamfProID=$( curl -k -H "Accept: text/xml" -H "Authorization: Bearer ${token}" $jamfProURL/JSSResource/computers/serialnumber/$mySerial/subset/general | xpath -e "//computer/general/id/text()" )
elif [[ "$osMajor" -eq 10 && "$osMinor" -gt 12 ]]; then
jamfProID=$( curl -k -H "Authorization: Bearer ${token}" $jamfProURL/JSSResource/computers/serialnumber/$mySerial/subset/general | xpath "//computer/general/id/text()" )
fi

curl -k -H "Authorization: Bearer ${token}" $jamfProURL/JSSResource/fileuploads/computers/id/$jamfProID -F name=@/private/tmp/$fileName -X POST

## Cleanup
rm /private/tmp/$fileName

exit 0

 

Reply


Terms & ConditionsCookie settings