Troubleshooting Direct Connect

Tanium as a Service is a self-monitored service, designed to detect failures before the failures surface to users. For more information, see Tanium as a Service Deployment Guide: Troubleshooting Tanium as a Service.

To collect and send information to Tanium for troubleshooting, collect logs and other relevant information.

Generate a support package

Collect information about the current state of the Direct Connect service to use for troubleshooting. The information is saved as a ZIP file that you can download with your browser.

  1. From the Direct Connect Home page, click Help , then the Troubleshooting tab.
  2. Click Generate Support Package.
  3. Click Download Support Package to download the ZIP file to the local download directory.
  4. Contact Tanium Support to determine the best option to send the ZIP file. For more information, see Contact Tanium Support.

Change the logging level

If you need greater verbosity in the logs, you can change the log level.

  1. From the Direct Connect Home page, click Help , then the Troubleshooting tab.
  2. Adjust the Log Level as needed.

    Possible values are: trace, debug, info (default), warn, error, fatal.

This update changes the log level for future logging. It does not affect the data that is available in the support package for previously logged events.

Troubleshoot endpoint connection issues

When you attempt an endpoint connection, Direct Connect iterates through the configured Tanium Servers or Zone Servers for an endpoint in this order until a successful connection occurs:

  1. LastGoodServerName (if available)
  2. The last server used for a successful connection
  3. Server with the most successful connections
  4. ServerName (if specified)
  5. Any servers specified in the ServerNameList

For more information about LastGoodServerName, ServerName, and ServerNameList, see Tanium Client Management User Guide: Settings for connections to Tanium Core Platform servers.

If you are unable to establish an endpoint connection, check the status of the Deploy Direct Connect - Open Session - operating system - session ID action from the Action History page.

If the action ran, but was not successful, check the <Tanium Client>/Logs/extensions0.txt log on the endpoint. Make sure that the endpoint can connect to the Module Server using the Fully Qualified Domain Name and Port that you configured on the Endpoint Connection tab in the Direct Connect settingsTanium as a Service using its fully qualified domain name and port 17486.

If the action did not run on the endpoint, make sure that the endpoint is a member of the Direct Connect action group and has the latest tools installed.

Troubleshoot connection issues through a zone proxy

To use Direct Connect with endpoints that connect to the Module Server through a Zone Server, you must install and configure the Direct Connect Zone Proxy. For more information, see Configure Zone Proxies.

If you are unable to establish an endpoint connection after installing and configuring the Direct Connect Zone Proxy, check the Direct Connect Zone Proxy log for errors: <Tanium>/TaniumDirectConnectZoneProxy/logs/proxy.log.

Remove Direct Connect tools from endpoints

You can deploy an action to remove Direct Connect tools from an endpoint or computer group. Separate actions are available for Windows and non-Windows endpoints.

  1. In Interact, target the computers from which you want to remove the tools. For example, ask a question that targets a specific operating system:
    Get Endpoint Configuration - Tools Status from all machines with Is <OS> equals True , for example: 
    Get Endpoint Configuration - Tools Status from all machines with Is Windows equals True
  2. In the results, select the row for Direct Connect , drill down as necessary, and select the targets from which you want to remove Direct Connect tools. For more information, see Tanium Interact User Guide: Drill Down.
  3. Click Deploy Action.
  4. On the Deploy Action page, enter Endpoint Configuration - Uninstall in the Enter package name here box, and select Endpoint Configuration - Uninstall Tool [Windows] or Endpoint Configuration - Uninstall Tool [Non-Windows], depending on the endpoints you are targeting.
  5. For Tool Name, select Direct Connect .

  6. (Optional) By default, after the tools are removed they cannot be reinstalled. To allow tools to be automatically reinstalled, clear the selection for Block reinstallation. Re-installation occurs almost immediately.

    If reinstallation is blocked, you must unblock it manually:

    • To allow Direct Connect to reinstall tools, deploy the Endpoint Configuration - Unblock Tool [Windows] or Endpoint Configuration - Unblock Tool [Non-Windows] package (depending on the targeted endpoints).

    • If you reinstall tools manually, select Unblock Tool when you deploy the Endpoint Configuration - Reinstall Tool [Windows] or Endpoint Configuration - Reinstall Tool [Non-Windows] package.

  7. (Optional) To remove all Direct Connect databases and logs from the endpoints, clear the selection for Soft uninstall.

  8. (Optional) To also remove any tools that were dependencies of the Direct Connect tools that are not dependencies for tools from other modules, select Remove unreferenced dependencies.

  9. Click Show preview to continue.
  10. A results grid displays at the bottom of the page showing you the targeted endpoints for your action. If you are satisfied with the results, click Deploy Action.

If you have enabled Endpoint Configuration, tool removal must be approved in Endpoint Configuration before tools are removed from endpoints.

Uninstall Direct Connect

Direct Connect is a shared service that is used by several Tanium solutions. If Direct Connect is in use by another Tanium solution, uninstalling Direct Connect or removing the tools from endpoints could have unintended consequences. Contact [email protected] to determine whether uninstalling Direct Connect is advisable in your environment.

  1. From the Main menu, go to Administration > Configuration > Solutions.
  2. In the Content section, select the Direct Connect row.
  3. Click Delete Selected and then click Uninstall to complete the process.

Contact Tanium Support

To contact Tanium Support for help, sign in to https://support.tanium.com.