[Camden Webster (camdenwebster)]

Summary

Jamf Connect Login is moving its plugin log from /tmp/jamf_login.log to /var/log/jamf_login.log (temp-file hardening). This makes Jamf Log Grabber collect the new path while still collecting the old one for older Login versions.

Jira: CON-6833

Must merge together with jamf/JamfConnectLogin#3447 and jamf/JCPyAutomation#95.

Support script owners per CODEOWNERS: klngbl nickander. The Script Expectations template asks for the Confluence release checklist to be reviewed first; please advise if anything further is needed from our side.

What changed

• support/Jamf-Log-Grabber/Jamf Log Grabber (Connect function only): copy /var/log/jamf_login.log to Connect/jamf_login_var_log.log, reporting success, "not found" (orange, same wording style) or "exists but could not be read" (red) in Results.html. Never aborts.
• Existing /tmp/jamf_login.log collection is kept unchanged except the not-found text now says "older Login versions". Both files may be present or absent (the new Login postinstall removes the old one).
• The new file is root:_securityagent, mode 0660, so it needs root. The script already assumes root-style execution (Jamf policy / Self Service, sudo for other files), so no privilege change was made; the unreadable message tells the operator to run as root.
• No README/docs referenced the log path.

How did I prove it works?

• Automated: bash -n passes; shellcheck -S error reports nothing. No test suite exists for this script.
• By hand: Not run against a real Login install.

Where to focus your review

• Look hard at: the new block in Connect() (about lines 294-307); filename jamf_login_var_log.log chosen so it cannot collide with the old jamf_login_tmp.log.

🤖 Generated with Claude Code

[Camden Webster (camdenwebster)]

I'll keep this in draft for now until the new Login version where this change is introduced is at least in RC/has a release date. Probably won't be until after the new year I'm guessing.

If you guys want to simplify your script here and also avoid issues with the new logs path, you could use the jamfconnect logs CLI to collect the logs for you. It'll grab both Login logs and Connect/Menubar logs for you:

camden.webster@MacBook-Pro ~ % jamfconnect logs --help
OVERVIEW: Collect Jamf Connect logs.

Collect various log information related to Jamf Connect. Upon successful completion will print the path to the directory where the logs were saved.

USAGE: jamfconnect logs [--output-directory <directory>] [--filename <name>] [--last <num [m|h|d]>] [--select-in-finder] [--quiet]

OPTIONS:
  -o, --output-directory <directory>
                          Output files to an existing directory or attempt to create a new one at the specified path. (default: /Library/Application Support/JamfConnect/Logs)
  -f, --filename <name>   Name of output file. (default: JamfConnectLogs)
  --last <num [m|h|d]>    Limits the captured events to the period starting at the given interval ago from the current time. Time is assumed in seconds unless specified. Example: "--last
                          2m" or "--last 3h" (default: 30m)
  --select-in-finder      Select the archive containing the log files in the Finder.
  -q, --quiet             Suppress any non-error output.
  -h, --help              Show help information.

Self Service+ has a similar CLI now with 2.34.0:

camden.webster@MacBook-Pro ~ % selfservice collect-logs --help
OVERVIEW: Gather logs to help troubleshoot issues

If successful, the final message on stdout will be the full path to the log archive

USAGE: selfservice collect-logs <output-directory> [--file-prefix <file-prefix>] [--open-finder]

ARGUMENTS:
  <output-directory>      The directory to put the log bundle in

OPTIONS:
  --file-prefix <file-prefix>
                          The desired log bundle name prefix. Will have a timestamp appended
  --open-finder           Open Finder to the folder containing the log bundle on completion
  -h, --help              Show help information.

The SSP one is supposed to include the Connect logs bundle as well, but that appears to be broken in the first version and should be fixed soon.