Home > Jamf Pro, Mac administration, macOS, Scripting > Running Jamf Pro inventory updates at startup time

Running Jamf Pro inventory updates at startup time

With the release of macOS Ventura expected this month, an important topic to many Mac admins is having their systems management tools detect as quickly as possible which of their Macs have upgraded to macOS Ventura. The reasons for this are varied, but one particular reason is to get configuration profiles deployed as soon as possible to manage new features and functionality in macOS Ventura.

One way to ensure quick detection if you’re using Jamf Pro is to have your managed Macs submit an inventory update to the Jamf Pro server when the Mac starts up. For one way to do this, please see below the jump.

For Macs managed by Jamf Pro, it’s possible to trigger the Jamf agent from the command line to do the following tasks:

  1. Verify that the Jamf agent on the Mac can contact the Jamf Pro server.
  2. Collect an inventory update from the Mac and submit it to the Jamf Pro server

The commands to do so are the following:

Verify connection to the Jamf Pro server:


/usr/local/jamf/bin/jamf checkJSSConnection

view raw

gistfile1.txt

hosted with ❤ by GitHub

Collect and submit an inventory update to the Jamf Pro server:


/usr/local/jamf/bin/jamf recon

view raw

gistfile1.txt

hosted with ❤ by GitHub

The following command should do the following:

  1. Try for 60 seconds to verify the connection to the Jamf Pro server
  2. If connection is successfully verified, collect and submit an inventory update to the Jamf Pro server.


/usr/local/jamf/bin/jamf checkJSSConnection -retry 60 && /usr/local/jamf/bin/jamf recon

view raw

gistfile1.txt

hosted with ❤ by GitHub

Note: The && in the command will ensure that the second command (the inventory update) will only run if the previous command runs without errors. If the connection can’t be verified, the jamf checkJSSConnection command will exit with an error status. The error status will mean that the subsequent inventory update command won’t be executed.

The command above can be added to a LaunchDaemon like the one shown below. Installing this LaunchDaemon will ensure that the two commands (connection verification and inventory update) are run every time the Mac starts.


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.github.runjamfproinventoryupdate</string>
<key>ProgramArguments</key>
<array>
<string>sh</string>
<string>-c</string>
<string>/usr/local/jamf/bin/jamf checkJSSConnection -retry 60 && /usr/local/jamf/bin/jamf recon</string>
</array>
</dict>
</plist>

You can deploy this LaunchDaemon using a script like the one shown below. The example script shown below will do the following:

  1. Create the LaunchDaemon file on the Mac in question.
  2. Set the correct permissions on the LaunchDaemon file
  3. Install the LaunchDaemon file into /Library/LaunchDaemons
  4. Load the LaunchDaemon
  5. Verify that the LaunchDaemon is in place and loaded.

Note: Once the LaunchDaemon is loaded, the Jamf agent on Mac will immediately perform the following actions:

  1. Try for 60 seconds to verify the connection to the Jamf Pro server
  2. If connection is successfully verified, collect and submit an inventory update to the Jamf Pro server.

The LaunchDaemon will also be loaded by the Mac at startup, so the same actions will also performed any time the Mac starts up.


#!/bin/bash
# Script which installs a LaunchDaemon which runs a Jamf inventory update at startup time.
#
# The LaunchDaemon takes the following actions:
#
# * Verifies that the Mac can communicate with the Jamf Pro server.
# * Sends an updated inventory to the Jamf Pro server
#
# Create the jamf_inventory_update_at_boot LaunchDaemon by using cat input redirection
# to write the XML contained below to a new file.
#
# The LaunchDaemon will run when when loaded and also when the Mac boots up.
# Set the identifier for the LaunchDaemon
LaunchDaemonName="com.github.runjamfproinventoryupdate"
# Set exit code
ERROR=0
# Create temp directory to store LaunchDaemon file inside at file creation time.
temp_directory=$(mktemp -d)
# Create the LaunchDaemon file
/bin/cat > "$temp_directory/$LaunchDaemonName.plist" << JAMF_PRO_INVENTORY_UPDATE_LAUNCHDAEMON
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
<key>Label</key>
<string>$LaunchDaemonName</string>
<key>ProgramArguments</key>
<array>
<string>sh</string>
<string>-c</string>
<string>/usr/local/jamf/bin/jamf checkJSSConnection -retry 60 && /usr/local/jamf/bin/jamf recon</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
JAMF_PRO_INVENTORY_UPDATE_LAUNCHDAEMON
# Once the LaunchDaemon file has been created, fix the permissions
# so that the file is owned by root:wheel and set to not be executable
# After the permissions have been updated, move the LaunchDaemon into
# place in /Library/LaunchDaemons.
/usr/sbin/chown root:wheel "${temp_directory}/${LaunchDaemonName}.plist"
/bin/chmod 644 "${temp_directory}/${LaunchDaemonName}.plist"
/bin/chmod a-x "${temp_directory}/${LaunchDaemonName}.plist"
/bin/mv "${temp_directory}/${LaunchDaemonName}.plist" "/Library/LaunchDaemons/${LaunchDaemonName}.plist"
# After the LaunchDaemon is place with proper permissions, load the LaunchDaemon.
# Loading the launchdaemon will trigger an Jamf Pro inventory update to be run.
if [[ -f "/Library/LaunchDaemons/${LaunchDaemonName}.plist" ]]; then
/bin/launchctl bootstrap system "/Library/LaunchDaemons/${LaunchDaemonName}.plist"
fi
# Remove temp directory
/bin/rm -rf "$temp_directory"
if [[ -f "/Library/LaunchDaemons/${LaunchDaemonName}.plist" ]]; then
LaunchDaemonLoaded=$(/bin/launchctl list | grep -o "$LaunchDaemonName")
if [[ -n "$LaunchDaemonLoaded" ]]; then
echo "$LaunchDaemonName LaunchDaemon is loaded. Jamf Pro inventory updates will run when the Mac boots."
else
echo "ERROR: $LaunchDaemonName LaunchDaemon is not loaded."
ERROR=1
fi
else
echo "ERROR: $LaunchDaemonName.plist LaunchDaemon file was not created successfully."
ERROR=1
fi
exit "$ERROR"

  1. Shri Sivakumaran
    November 2, 2022 at 8:57 am

    Hi rtrouton, getting below error on Ventura Mac when running the above script
    /Library/LaunchDaemons/com.github.runjamfproinventoryupdate.plist: Invalid property list
    Bootstrap failed: 109: Invalid property list

    • Shri Sivakumaran
      November 2, 2022 at 11:03 am

      nvrmnd it worked after I copied script from raw page.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: