Scripts | How to Report Last Restart macOS

Purpose: To identify when a device last restarted and be able to track that data inside an MDM. 

Summary:

Have you ever run into users that say they have restarted their computers, but haven't? This simple script and variable will allow you to report the last time a user has restarted their computer, as long as their computer is currently checking in with the MDM. For this description and demo, we will be using the MDM Jamf Pro, but you should be able to adapt this to any MDM for macOS.

Script:

Color Codes:

Variables = Green

#!/bin/bash

bootTime=$(sysctl kern.boottime | awk '{print $5}' | tr -d ,)
bootTimeFormatted=$(date -jf %s $bootTime +%F\ %T)
echo "$bootTimeFormatted"

Explained:

bootTime=$(sysctl kern.boottime | awk '{print $5}' | tr -d ,)

This line is taking the System's Boot time from the Kernal sysctl command and grabbing the 5th variable from the result and formatting it, removing any excess characters.

bootTimeFormatted=$(date -jf %s $bootTime +%F\ %T)

This line is taking the date command and formatting the time into days. If you would like to format your boot time into another time period see the manual. 

   -j = Do not try to set the date.  This allows you to use the -f flag in addition to the + option to convert one date format to another.  Note that any date or time components unspecified by the -f format string take their values from the current time.

echo "$bootTimeFormatted"

Finish by repeating the formatted time back as output. 

Jamf Extension Attribute:

For Jamf, navigate to Settings > Computer Management > Extension Attributes

The only difference is for an extension attribute you need to add result condition around your ending variable:

<result>$variable</result>

#!/bin/bash
bootTime=$(sysctl kern.boottime | awk '{print $5}' | tr -d ,)
bootTimeFormatted=$(date -jf %s $bootTime +%F\ %T)
echo "<result>$bootTimeFormatted</result>"

For the Extension Attribute:

1. Create a Display Name
2. Optional: Add a description
3. Data Type: Date (YYYY-MM-DD hh:mm:ss)
4. Inventory Display: Extension Attributes
5. Input Type: Script

1. Copy and Paste Script into box

• Remember to keep #!/bin/bash at the top

Save your Extension Attribute and wait for a device to check-in. This variable should show up under the Extension Attribute tab unless you changed the category to something else for Inventory Display. 

Here is the result in the computer record:

Additional Tips:

You could then base a Smart Group around sending a message to computers to restart within a specific time period. You could also create inventory records based on the date last restarted.

Computers > Search Inventory > Advanced Computer Search

1. Click Criteria and + Add:
2. Show Advanced Criteria
3. Find the Name of your Extension Attribute and click Choose
4. Choose an Operator
5. 1. before (yyyy-mm-dd)
   2. after (yyyy-mm-dd)
   3. more than x days ago
   4. less than x days ago
6. Choose a Value to meet the operator

Resources:

• Sysctl Manual Page
• Date Manual Page
• Jamf Extension Attributes
• Jamf Advanced Computer Searches