Launchdaemon run script issues

[_aDiedericks]

Hi there,

I have a script that runs once on each machine in our macOS fleet. The script essentially creates a launchdaemon that runs a script that kills and restarts jamf binaries on machines once a day to mitigate the jamf checkin issues (no we do not have a force restart schedule).

Issue I'm noticing is that some devices (about 50) even though they have the launchdaemon loaded it doesn't seem to be restarting their Jamf binaries. My thinking is it may be the script that is not working as intended.

I intend for the restart script to be re-ran everyday on the local machine but some devices have not checked in for weeks now.

#!/bin/sh

cat << 'EOF' > /private/var/tmp/JamfRestart.sh
#!/bin/sh
sudo killall jamf
sleep 10
sudo jamf policy
EOF

chmod 755 /private/var/tmp/JamfRestart.sh
chown root:wheel /private/var/tmp/JamfRestart.sh

cat << EOF > /Library/LaunchDaemons/com.JamfRestart.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>EnvironmentVariables</key>
	<dict>
		<key>PATH</key>
		<string>/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Library/Apple/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/usr/local/sbin:/opt/local/bin</string>
	</dict>
	<key>Label</key>
	<string>JamfRestart</string>
	<key>ProgramArguments</key>
	<array>
		<string>/bin/sh</string>
		<string>/private/var/tmp/JamfRestart.sh</string>
	</array>
	<key>RunAtLoad</key>
	<false/>
	<key>StartInterval</key>
	<integer>86400</integer>
</dict>
</plist>
EOF

chmod 644 /Library/LaunchDaemons/com.JamfRestart.plist
chown root:wheel /Library/LaunchDaemons/com.JamfRestart.plist
launchctl load -w /Library/LaunchDaemons/com.JamfRestart.plist

[sdagley]

@_aDiedericks You really don't want to put scripts you need to be on the Mac long term in /private//var/tmp. A better location would be something like "/Library/Management/MyOrgName" or "Library/Application Support/MyOrgName"

[_aDiedericks]

Thanks, I'll onboard this info on my end and make the adjustments. Do you know how I can log the output of the script's last run? Referring to within the "JamfRestart.sh" script.

[sdagley]

You'd need to put code into your script that would write to a file in /var/log. Here's a useful example of that: https://community.jamf.com/t5/jamf-pro/script-log-to-text-file/m-p/137935/highlight/true#M127017

[_aDiedericks]

Thanks. Got the log working.

[jamf-42]

JAMF Checkin issue? is there a PI for this? Anyone else seeing this? 

[_aDiedericks]

It's not a general issue. Some people have it, some dont. I think it's due to a policy/script running during jamf policy update on devices that doesn't exit or complete that causes jamf binaries to hang indefinitely until the process is killed or device is restarted.