Logging

Events from SAP Privileges are gathered alongside each PrivilegesDemoter decision made by the user and logged in /var/log/privileges.log

Events from SAP Privileges will look like this 2022-09-07 12:11:03.343 Df corp.sap.privileges.helper[1369:4df13b] SAPCorp: User mostly.mac has now admin rights on MachineID: DD43D462-57B4-4C5D-91CC-D430507277D1

Events from PrivilegesDemoter will look like this 2022-09-07 12:16:30-0400 blog.mostlymac.privileges.demoter Decision: mostly.mac no longer needs admin rights. Removing rights on MachineID: DD43D462-57B4-4C5D-91CC-D430507277D1 now.

If using a Jamf Pro policy to demote users, logs will also be captured in the Jamf Pro policy logs.

---

Note: SAP Privileges logs from the last 5 minutes are captured each time the PrivilegesDemoter script runs using the following command:
log show --style compact --predicate 'process == "corp.sap.privileges.helper"' --last 5m | grep "SAPCorp"

If the PrivilegesDemoter script does not run, the SAP Privileges logs will not be collected. Additionally, it is possible that logs from SAP Privileges and PrivilegesDemoter can be listed out of chronological order depending on usage and timing of events.