To collect and send information to Tanium for troubleshooting, collect log and other relevant information.
The information is saved as a compressed ZIP file that you can download with your browser.
- From the Asset home page, click Help , then the Troubleshooting tab.
- Collect the troubleshooting package. Click Collect. To collect additional information Postgres table statistics that includes information bad tuples, live, last vacuum, and so on, click Collect Detailed. When the ZIP file is ready, you can download the tanium-asset-support-[timestamp].zip file to your local download directory.
- Attach the ZIP file to your Tanium Support case form or send it to your TAM.
In the ZIP file, you can view the following information:
- postgresql-xx.log : Contains Postgres log file.
- info directory: Contains CSV files for Asset configurations, including attribute configurations, destinations, permissions, and so on. If you click Collect Detailed, a CSV file for postgres statistics (pg-stats.csv) is also created.
- job directory: Contains logs for the data imports and exports.
- From the Asset home page, click Settings , then the Advanced Settings tab.
- Change the Service Account Log Level.
- Click Save.
View status of imports and exports
- : Scheduled
- : Successful
- : Error
- : Running
View import and export logs
In the ZIP file that you download from the Troubleshooting tab, you can view logs for the data imports and exports. These logs are in the job directory:
ServiceNow export logs are named with the following format: job/date_time_job#_servicenow_config#.log. If you enable Trace level logging on your ServiceNow configuration, numbered subdirectories, for example job/65, are created that contain all of the POST and GET requests for that job. See Add ServiceNow as a destination for more information about configuring logging.
Asset data imports
You can use these logs to view details about the scheduled runs that are occurring to import asset data from Tanium into your Asset database.Tanium data import logs are named with the following format: job/date_time_job#_tanium_1.log. For data you are importing from a database, import logs are named with the following format: job/date_time_job#_database_1.log. To change the log level for imports, see Configuring sources.
Remove unneeded data from the Asset database
You can configure data retention and automatic vacuuming on the Asset database.
- From the Asset home page, click Settings , then the Data Settings tab.
- To purge stale assets that have not been seen by Asset from the database, select Purge Stale Assets. Then, indicate the age of stale data to remove. The minimum number is seven days.
- To adjust the trigger and amount of work done during automatic vacuuming, adjust the Cost Limit and Size Factor values. The Postgres VACUUM operation reclaims storage that is occupied by dead tuples. By default, the database is vacuumed when 1% of tuples are considered dead, and the cost limit (amount of work per vacuum cycle) is set to 1000.
- Click Save.
- From the Main menu, click Tanium Solutions. Under Asset, click Uninstall. Click Proceed with Uninstall to complete the process.
- Remove Asset Tools from your endpoints. To see which endpoints have the file evidence tools installed, ask the question: Get Asset File Evidence Status from all machines. If you want to clean the artifacts from your endpoints, contact your TAM.
- A backup asset-files folder gets created as part of the uninstall process. You can keep or delete this folder. If any other Asset artifacts remain on your Module Server, contact your TAM.
- Remove Asset saved questions. You can remove saved questions that meet all the following conditions:
- Owned by the service account you configured for Asset
- AND the name of the saved question starts with Asset
- AND is in the Asset content set
- Remove Asset scheduled actions. Delete the Asset Deploy Collect Active Directory Info scheduled action that is created by the service account and running the Asset Collect Active Directory Info package.
- Remove Asset action group. After the action group is empty, you can delete the Tanium Asset action group.
Last updated: 3/12/2019 2:29 PM | Feedback