Title
#fleet
o

Ojas

08/19/2022, 7:45 AM
how can i find jamf logs in osquery. So we have a certain service which runs from a self help app and i want to monitor when it is started by a person. I see jamf logs it when it starts but i cant find the exact log for it in osquery. I see log in console.
j

Jason

08/19/2022, 11:55 AM
There is the last_opened_time column in the apps table.
o

Ojas

08/19/2022, 2:21 PM
how would that give me jamf logs
j

Jason

08/19/2022, 2:21 PM
I guess maybe I'm not understanding what are looking to do. Fleet isn't for reading logs
o

Ojas

08/19/2022, 2:22 PM
but osquery is right. I am trying to query from fleet to my osquery agent on mac to fetch jamf logs
j

Jason

08/19/2022, 2:22 PM
There is a file read extension as part of the macadmins extension bundled with orbit. You might be able to use that
2:23 PM
But osquery isn't designed to read log files from endpoints
Kathy Satterlee

Kathy Satterlee

08/19/2022, 3:33 PM
I've tried to hunt down an osquery extension that would give you access to those logs, but I'm coming up empty so far.
j

Jason

08/19/2022, 3:38 PM
file_lines or unified_log might work
Kathy Satterlee

Kathy Satterlee

08/19/2022, 4:05 PM
Are there other things that happen when that service runs? Does it have its own log file that it updates? Does it install a package? Is there something that might show up in
process_events
? A dedicated user account?
4:12 PM
Would YARA scanning to the trick here? https://osquery.readthedocs.io/en/1.8.2/deployment/yara/
o

Ojas

08/19/2022, 7:58 PM
@Kathy Satterlee logs are seen in jamf.log file it runs a process called make me admin it does say installing but not sure if behind its just updating privs
Kathy Satterlee

Kathy Satterlee

08/19/2022, 8:24 PM
8:40 PM
If so, it looks like there is a log created at
/private/var/userToRemove/<user>.logarchive
once they've timed out: https://github.com/jamf/MakeMeAnAdmin/blob/2ae5ec4204b6db7e2844a0090936a4967ce96979/MakeMeAnAdmin.sh#L83 And an entry added to
/private/var/userToRemove/user
while the privileges are active: https://github.com/jamf/MakeMeAnAdmin/blob/2ae5ec4204b6db7e2844a0090936a4967ce96979/MakeMeAnAdmin.sh#L60 So you could check to see if those files exist/have been updated recently
8:42 PM
Or, if you have file carving enabled, you could pull the JAMF logs 🙂
o

Ojas

08/22/2022, 8:24 AM
Carving does give me file name but i guess i need to configure it to send it to s3 coz i dont see any option to read it direct in fleet.
8:24 AM
As for file monitoring i am trying to use the same path as you said above but that dosent give me back file names. 😞
Kathy Satterlee

Kathy Satterlee

08/22/2022, 2:17 PM
Can you show me what that query looks like?
o

Ojas

08/23/2022, 4:27 AM
hey Kathy Many thanks i got the files. i was using different parameter but on debugging found this query works SELECT path FROM file WHERE path LIKE ‘%%/var/userToRemove/%%’;
Kathy Satterlee

Kathy Satterlee

08/23/2022, 5:05 AM
Nice!!