Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

Data and Tables Affected by Log Flushing

Overview

This article outlines the types of logs and respective data that can be flushed, as well as the database tables that are affected.

Versions Affected

Jamf Pro 9.0 or later

Note: Some log types have been added since the release of 9.0, as noted in the table.

Log Type Flushed Data Table Affected
Application Usage logs Amount of time each application was in the foreground on a computer application_usage_logs
Computer Usage logs - Startup dates/times
- Login and logout dates/times
- Usernames used to log in and out of the computer
usage_logs
Policy logs - Date/time that the policy ran on the computer
- Status of the policy
- Actions logged for the policy
Note: Policy Log Flushing will not cause any policies to run again. The Jamf Pro server will completely remove the policy entries past the point of log flushing with the exception of the last recorded action.
- logs (logs.type=”policy”)
- log_actions
- policy_history
Jamf Remote logs - Date/time that the Jamf Remote event took place
- Status of the Jamf Remote event
- Actions logged for the Jamf Remote event
- logs (logs.type="remote")
- log_actions
Screen sharing logs - Date/time that the screen sharing session took place
- Status of the screen sharing session
- Details of the screen sharing session
- logs (logs.type="vnc")
- log_actions
Jamf Imaging logs - Date/time that the computer was imaged
- Status of the imaging event
- Actions that took place during the imaging event
- logs (logs.type="autorun")
- log_actions
Computer and mobile device management history List of all completed, pending, and failed MDM commands mobile_device_management_commands
Computer inventory reports Computer inventory information from past inventory submission
Note: The last inventory report is always kept. For example, if an application was installed three weeks ago, but log flushing for computer inventory reports was set to flush data older than two weeks, Jamf Pro will still have a record of that application's installation on the computer.
- applications
- extension_attribute_values
- fonts
- hard_drive_partitions
- hard_drives
- hardware_reports
- ibooks_installed
- operating_systems
- plugins
- reports
Mobile device inventory reports Mobile device inventory information from past inventory submissions - mobile_device_details
- mobile_device_extension_attribute_values
- mobile_device_installed_applications
- mobile_device_installed_certificates
- mobile_device_installed_profiles
- mobile_device_installed_provisioning_profiles
- reports
Jamf Pro access logs - Successful/failed logins
- IP address from the login
- How the device accessed Jamf Pro
jss_access_logs
Change Management logs
(added in 9.31)
- Date/time the change took place
- Username of the administrator who made the change
- Object type
- Object name
- Action
- Details about the change
object_history
Event logs
(added in 9.64)
- Date/time the status was last updated for an event
- Name of the device that is in the scope of an event
- Object type
- Object name associated with an event
- Action of the event
- Status of the event
event_logs

Additional Information

For more information about log flushing, see Flushing Logs in the Jamf Pro Administrator's Guide.

Like Comment
Order by:
SOLVED Posted: by freddie.cox

Under Tables Affected the logs_actions table is named log_actions as of version 9.91. Not trying to be pedantic but would have helped one of my searches this morning. :-)

Obviously, I ended up finding the right place so thanks so much for having this table available!

Like
SOLVED Posted: by dukedan

How do we manage the jss_audit database table size?
Thanks.
Dan

Like
SOLVED Posted: by donmontalvo

Yes, Start Time is in JSS Jamf prefs, but how do we tell when it actually ends?

"Where is the log, Kenneth?" - Atos

If it is in the JSS Server log, is there a string we should search for?

TIA,
Don

Like
SOLVED Posted: by donmontalvo

Quick follow up, Jamf Support responded a while back, and confirmed still to be the case, there is no way to tell when log flushing completes.

Like
SOLVED Posted: by jtrant

Confirming that there is still no way to view the progress of the log flushing. Enabling full statement logging on the server can give a little more visibility, though.

In our case, flushing 7GB of logs (we had a runaway policy running at checkin) took two hours. This was in preparation for an upgrade to 10.2.1 which took less than 30 minutes on the 6GB database file that remained after log flush.

Like
SOLVED Posted: by benducklow

Can anyone help identify which log flushing setting affects the history of packages and scripts? I know that info gets purged, but not seeing those tables identified here in this KB. As someone with multiple people accessing, creating, modifying things in Jamf Pro objects, this information would be good to know and perhaps adjust our retention of these logs based on that.

Like

Jamf wants to hear your feedback around Jamf Pro: LDAP Servers and Reports!