Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

how can i find jamf logs in osquery. So we have a certain service which runs from a self help app and i want to monitor when it is started by a person.

I see jamf logs it when it starts but i cant find the exact log for it in osquery. I see log in console.

There is the last_opened_time	column in the apps table. 

I guess maybe I'm not understanding what are looking to do. Fleet isn't for reading logs 

but osquery is right. I am trying to query from fleet to my osquery agent on mac to fetch jamf logs

There is a file read extension as part of the macadmins extension  bundled with orbit. You might be able to use that 

But osquery isn't designed to read log files from endpoints 

I've tried to hunt down an osquery extension that would give you access to those logs, but I'm coming up empty so far. 

Are there other things that happen when that service runs? Does it have its own log file that it updates? Does it install a package? Is there something that might show up in `process_events`? A dedicated user account?

Would YARA scanning to the trick here?

<https://osquery.readthedocs.io/en/1.8.2/deployment/yara/>

<@U02KY9FDA59> logs are seen in jamf.log file
it runs a process called make me admin
it does say installing but not sure if behind its just updating privs

Is this the utility?:
<https://github.com/jamf/MakeMeAnAdmin/blob/master/MakeMeAnAdmin.sh>

If so, it looks like there is a log created at `/private/var/userToRemove/&lt;user&gt;.logarchive` once they've timed out:

<https://github.com/jamf/MakeMeAnAdmin/blob/2ae5ec4204b6db7e2844a0090936a4967ce96979/MakeMeAnAdmin.sh#L83>

And an entry added to `/private/var/userToRemove/user` while the privileges are active:

<https://github.com/jamf/MakeMeAnAdmin/blob/2ae5ec4204b6db7e2844a0090936a4967ce96979/MakeMeAnAdmin.sh#L60>

So you could check to see if those files exist/have been updated recently

Or, if you have <https://fleetdm.com/docs/using-fleet/fleetctl-cli#file-carving|file carving> enabled, you could pull the JAMF logs :slightly_smiling_face:

Carving does give me file name but i guess i need to configure it to send it to s3 coz i dont see any option to read it direct in fleet.

As for file monitoring i am trying to use the same path as you said above but that dosent give me back file names. :disappointed:

Can you show me what that query looks like? 

hey Kathy
Many thanks i got the files.
i was using different parameter but on debugging found this query works
SELECT path FROM file WHERE path LIKE ‘%%/var/userToRemove/%%’;