If you like DetectX Swift and want to integrate it with Munki, this is how I did it. Hat tip to Zack McCauley for doing the heavy lifting, which I’m now building on. I’d recommend you read his blog post first.
So instead of having an Outset script or separate Launch Agent, I decided to put the DetectX Swift scan as part of the Munki run (specifically a script in the postflight.d directory (if you put it in a preflight, it will be a blocking application that will prevent DetectX Swift from doing an unattended install upgrade) that MunkiReport creates):
It’s best to use a separate Launch Daemon (example here), because the scan can sometimes take over a minute, and MunkiReport scripts will time out after ten seconds.
# Run a DetectX Swift scan
/Applications/Utilities/DetectX\ Swift.app/Contents/MacOS/DetectX\ Swift search -aj /usr/local/munki/preflight.d/cache/detectx.json
Outside of MunkiReport (but connecting to the MunkiReport MySQL database), I have a script that generates a Python list of files that DetectX Swift has flagged as “issues”:
$result=mysqli_query($YOURDATABASECONNECTION, $query);
if(mysqli_num_rows($result)>0){
// Create an array to store the results
$larger_issues=array();
while($row=mysqli_fetch_assoc($result)){
// Create an array based on a semi-colon delimiter
$smaller_issues=explode(“;”, $row[‘issues’]);
foreach($smaller_issues AS $smaller_issue){
if((trim($smaller_issue)!=”) AND (!in_array($smaller_issue, $larger_issues))){
array_push($larger_issues, $smaller_issue);
}
}
// End fetching results
}
if(!empty($larger_issues)){
echo ‘<p>okay_to_delete = [ ‘;
$counter=0;
while($counter+1<count($larger_issues)){
echo ‘\” . $larger_issues[$counter] . ‘\’,<br />’;
$counter+=1;
}
echo ‘\” . $larger_issues[$counter] . ‘\’ ]</p>’;
//print_r($larger_issues);
// End checking there are elements in larger issues (there should be)
}
// End checking there are any issues
}
And finally I have a nopkg to do the actual cleaning of the issues DetectX flagged.
So why even have an array of okay-to-delete things?
Well, DetectX Swift has command-line options to scan, but it (at least as of this writing) does not have the option to command-line remove things, presumably so someone has a chance to review the things removed before actually removing them. Also, since it’s just forcefully removing things (yes, I know about using shutil to remove, but I’ve run into weird situations in which that doesn’t work consistently, so I’m using a subprocess to invoke rm instead), it’s probably a good idea for at least one human to review things before they get removed.
The nopkg also copies the .json to /var/log (with a datetime stamp in the name) before removing anything.
One response to “Integrating DetectX Swift with Munki”
[…] Siu just shared his method for hourly scans by integrating more directly with Munki. As a bonus he has auto removal of issues functioning as […]