View Mac Device Logs
Click 'Devices' > 'Device List' > 'Device Management' > click the name of a Mac device > 'Logs'
- The 'Logs' tab shows all events that occurred on a specific device.
- This contrasts to 'Dashboard' > ‘Audit Logs’, which shows events on all devices.
View device logs
- Click 'Devices' > 'Device List'
- Click the 'Device Management' tab in the top-menu
- Select a company or a group to view just their devices
OR
- Select 'Show all' to view every device enrolled to EM
- Click the name of a Mac OS device
- Click the 'Logs' tab
There are two types of logs, each shown on a different tab. Each row on these tabs is a specific event.
Click on the following for details about each type of log:
A record of all events where an
alert was generated on the endpoint. For example, logs are generated
a breach of monitoring conditions.
View alert logs
- Click 'Devices' > 'Device List'
- Click the 'Device Management' tab in the top menu
- Select a company or a group to view just their devices
Or
- Select 'Show all' to view every device enrolled to EM
- Click the name of the Mac OS device then select the 'Logs' tab
- Select 'Alert Logs'
Column Heading |
Description |
---|---|
Alert Name |
The alert template used in the event.
|
Trigger Name |
The monitor that generated the alert.
|
Trigger Type |
The possible value is 'Monitor'. |
Hits Count (24 H Period) |
The number of times this condition was triggered in the past 24 hours. |
- Monitors are scripts which keep track of specific items on a device. For example, you may set a monitor to track disk usage does not exceed a certain percentage.
- Monitors can be added to the 'Monitoring' section of a configuration profile
- Monitoring logs are shown for the past 24 hours.
- See Monitors for Mac OS Devices for help to create monitors.
- See Monitor settings for Mac OS Profile for help to add monitors to profiles
View monitoring logs
- Click 'Devices' > 'Device List'
- Click the 'Device Management' tab in the top-menu
- Select a company or a group to view just their devices
Or
- Select 'Show all' to view every device enrolled to EM
- Click the name of the Mac OS device then select the 'Logs' tab
- Click
'Monitoring Logs'
Monitoring Logs - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Monitor Name |
The monitor that was triggered to create the log.
|
Status |
Whether or not the monitor is currently active on the device. |
Hit Count |
The number of times the monitored condition was breached in the last 24 hours. |
Last Hit Time |
Date and time the condition was last broken. |
Last Update Time |
Date and time when the information was last refreshed. |
Details |
|
- Click the 'Details' link to view event information and the conditions of a monitor:
Details are shown under three tabs:
Logs - The date and time when the event occurred. Also shows details about
the monitoring rule that detected the event.
Monitoring Log Details - 'Logs' tab - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Time |
Date and time of the event. |
Status |
The current status of the monitored condition on the device. |
Additional Information |
Details on the condition monitored and the breach. |
Tickets - Shows any service desk tickets created by the events.
Monitoring Log Details - 'Tickets' tab - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Link |
A link to the support ticket created for the breach event.
|
Status |
Indicates whether the ticket is open or closed. |
Created On |
The date and time at which the ticket was created. |
Statuses - Shows the current status of all conditions monitored on the device.
Monitoring Log Details - 'Statuses' tab - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Condition Type |
The observed parameter of the monitor. Click the condition to view the details of the monitored parameter and configured thresholds. An example is shown below: |
Value |
The thresholds set for the parameter. |
Status |
Current state of the monitored parameter.
|
Status Changed at |
The date and time of the most recent change to the monitor status. |
The procedures log tab shows scripts that were manually run on Mac devices as well as those run automatically via a profile. For help to create and run script procedures, see Manage Procedures.
- Click 'Devices' > 'Device List'
- Click the 'Device Management' tab in the top-menu
- Select a company or a group to view just their devices
Or
- Select 'Show all' to view every device enrolled to EM
- Click the name of the Mac device then select the 'Logs' tab
- Click 'Procedures Logs'
Procedure Logs - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Procedure Name |
The label of the script procedure that was run on the device.
|
Started At |
The date and time when the procedure commenced. |
Started By |
Who or what launched the procedure.
|
Launch Type |
Whether the procedure was scheduled or run manually. |
Executed By |
The user account type used by Endpoint Manager to run the procedure. |
Finished At |
The date and time when the procedure was completed. |
Status |
Whether the script was
successful or not. You can configure an alert if a procedure deployment fails. See 'Manage Procedures' for help with this. |
Last Status Update |
The date and time when the information was last updated. |
Details |
|
View Script Procedure Log details
- Click the 'Details' link to view details about a procedure's execution:
The details are displayed under two tabs:
Statuses - The date and time at which successive stages in the procedure were run, their success status and results.
Script Procedure Log Details - 'Statuses' tab - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Time |
The date and time of the procedure execution. |
Status |
Whether the execution was successful or not. |
Additional Information |
Provides details on the execution:
|
Tickets- Displays tickets raised for any failed procedures.
Script Procedure Log Details - 'Tickets' tab - Table of Column Descriptions |
|
---|---|
Column Heading |
Description |
Link |
A link to the support ticket created for the breach event.
|
Status |
Indicates whether the ticket is open or closed |
Created On |
The date and time at which the ticket was created. |