Kandji Agent Command Line Interface

The Kandji Agent offers a suite of powerful Terminal commands that give admins additional control and information for their fleet of devices. While some commands can only be executed locally on a device using Terminal, others can be deployed through a Custom Script Library Item for greater flexibility.

Local-Only Commands

The following commands must be executed directly on a device in Terminal. They cannot be deployed via a Custom Script or a Custom App Library Item.

Run

The agent will run and check in immediately. Normally, the agent checks in every 15 minutes. Without an internet connection, the agent will run in offline mode.

sudo kandji run

Adding --reset-daily to the run command will run all Parameters, including those that are run only once per day.

sudo kandji run --reset-daily

Run Daily MDM Inventory Update

The agent will request the MDM server to initiate its daily MDM commands, such as validating Apps & Books from Apple Business Manager, as well as querying certain device information.

sudo kandji update-mdm

Collect Apps

Collects full application inventory from the Mac.

sudo kandji collect-apps

Run Library Items

Checks for library items to execute.

sudo kandji library

Available library command options:

Print Kandji Logs

Prints log entries for the Kandji Agent subsystem from the unified logging system. The `--last` option is required and specifies the number of previous seconds to print logs from. Replace <seconds> with a number, like 300. (Actual results displayed are limited based on available unified log storage.)

Redirect the output of the command using > to save to an external log file.

sudo kandji logs --last <seconds>

Available logs command options:

Enable debug logging.

sudo log config --mode "level:debug" --subsystem io.kandji.KandjiAgent

Disable debug logging.

sudo log config --mode "level:default" --subsystem io.kandji.KandjiAgent

Example debug logging command usage.

sudo kandji logs --no-format --debug --last 10000 >~/Desktop/kandji.log

Logging Subsystems

The logging subsystems available in the Kandji Agent offer granular and targeted logging.

Subsystem predicate log command.

sudo log show --predicate 'subsystem beginsWith "io.kandji"'

Available predicate log command options:

Subsystem predicate log command with options.

sudo log show --predicate 'subsystem beginsWith "io.kandji.daemon"' --info --debug

Available logging subsystems:

• io.kandji.beekeeper

• io.kandji.cli

• io.kandji.daemon

• io.kandji.installer

• io.kandji.library-manager

• io.kandji.menu

• io.kandji.passport

• io.kandji.parameter-agent

• io.kandji.self-service

• io.kandji.liftoff

Avert

List quarantined files.

sudo kandji avert --list-quarantine

Delete quarantined files.

sudo kandji avert --delete-quarantine

Scriptable Commands

These commands can be executed through a Custom Script or a Custom App Library Item. They can also be run locally on a Mac in Terminal.

When using the scriptable options below, such as within a Custom Script Library Item, you must replace sudo kandji with the the full path to the binary: /usr/local/bin/kandji

Reboot

This option can be used in scripted workflows to force a reboot leveraging the Kandji Agent and menu bar application. It is visually similar to the reboot forced during FileVault enablement or a Managed OS upgrade.

This initiates a restart by prompting the logged-in user with a countdown timer. If no delay is specified, the default 1800 (30 minutes) will be used. If no user is logged in, the delay will be ignored, and the Mac will restart immediately.

sudo kandji reboot --delaySeconds NumberOfSeconds

Forces a restart without giving users the option to delay.

sudo kandji reboot --no-deferral 

Dock

This option can be used in scripted workflows to add items to the end of the macOS Dock or remove items from the macOS Dock of the currently logged-in user.

The application referred to by the bundle identifier must be in the /Applications folder.

Optionally specifying the --all option adds the icon to the end of the Dock for all user accounts.

sudo kandji dock [--add bundle identifier] [--remove bundle identifier] [--all]

If using multiple options at a time, use a single command, and separate options using quotes and separating spaces, as shown in the example below.

/usr/local/bin/kandji dock --add "com.google.Chrome us.zoom.xos com.tinyspeck.slackmacgap"

Alert

This command can be used in scripted workflows to present an alert to users.

sudo kandji display-alert [--title text] [--message text] [--icon path_to_image] [--suppression-key string] [--help-url url] [--no-wait]

It has several options, outlined below.

Below is an example of the underlying command for an alert and the resulting experience in macOS Sequoia:

sudo /usr/local/bin/kandji display-alert --title "Low Disk Space" --message "Your Mac computer's Hard Drive is running critically low on space, please contact Accuhive IT as soon as possible." --suppression-key accuhive --help-url https://kandji.io --no-wait

Submit Diagnostics

Submit Diagnostics to Kandji. Equivalent to the action menu (gear) item available in the Kandji Menu.

sudo kandji submit-diagnostics [--comment text]

Available submit-diagnostics command option:

Version

Display the installed Kandji Agent version.

sudo kandji version

Help

Display help text.

sudo kandji help