From 294ba732f8c48e3f33b28780f2b1114c386ffb67 Mon Sep 17 00:00:00 2001 From: Camden Webster Date: Wed, 11 Nov 2026 09:32:35 -0600 Subject: [PATCH] CON-6833 Collect Jamf Connect Login log from /var/log as well as /tmp Root cause: Jamf Connect Login (jamf/JamfConnectLogin#3447) moves its plugin log from world-writable /tmp/jamf_login.log to /var/log/jamf_login.log (root:_securityagent, 0660) as temp-file hardening. The grabber only looked in /tmp, so newer installs would silently yield no Login plugin log. Collect the new path (reporting missing/unreadable in the existing results style instead of aborting) and keep collecting the old /tmp file for older Login versions. Co-Authored-By: Claude --- support/Jamf-Log-Grabber/Jamf Log Grabber | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/support/Jamf-Log-Grabber/Jamf Log Grabber b/support/Jamf-Log-Grabber/Jamf Log Grabber index 0770621..ab6bf6f 100644 --- a/support/Jamf-Log-Grabber/Jamf Log Grabber +++ b/support/Jamf-Log-Grabber/Jamf Log Grabber @@ -291,9 +291,20 @@ Connect() { echo $kerblist > $connect/klist_manuallyCollected.txt; fi #CHECK FOR JAMF CONNECT LOGIN LOGS AND PLIST, THEN COPY AND CONVERT TO A READABLE FORMAT + #CURRENT LOGIN PLUGIN LOG IS /var/log/jamf_login.log (root:_securityagent, 0660, needs root to read) + if [ -e /var/log/jamf_login.log ]; then + if cp "/var/log/jamf_login.log" "$connect/jamf_login_var_log.log" 2>/dev/null; then + printf '%s
' "white" "-Collected /var/log/jamf_login.log" >> $results + else + printf '%s
' "red" "-Jamf Login /var/log/jamf_login.log exists but could not be read
-This file requires root. Run this script as root (for example via a Jamf policy or sudo)." >> $results + fi + else + printf '%s
' "orange" "-Jamf Login /var/log/jamf_login.log not found
-This only exists on newer Jamf Connect Login versions.
-Don't worry if you don't see anything. We're just being thorough." >> $results + fi + #OLDER LOGIN VERSIONS WRITE TO /tmp/jamf_login.log if [ -e /tmp/jamf_login.log ]; then cp "/tmp/jamf_login.log" $connect/jamf_login_tmp.log else - printf '%s
' "orange" "-Jamf Login /tmp file not found
-This usually only exists on recent installs.
-Don't worry if you don't see anything. We're just being thorough." >> $results + printf '%s
' "orange" "-Jamf Login /tmp file not found
-This usually only exists on older Login versions.
-Don't worry if you don't see anything. We're just being thorough." >> $results fi if [ -e /Library/Managed\ Preferences/com.jamf.connect.login.plist ]; then cp "/Library/Managed Preferences/com.jamf.connect.login.plist" "$connect/com.jamf.connect.login_managed.plist" | plutil -convert xml1 "$connect/com.jamf.connect.login_managed.plist" | log show --style compact --predicate 'subsystem == "com.jamf.connect.login"' --debug > "$connect/com.jamf.connect.login.log"