To collect and send information to Tanium for troubleshooting, collect log and other relevant information.

Collect logs

The information is saved as a compressed (.zip) file that you can download with your browser.

  1. From the Discover home page, click Help , then the Troubleshooting tab.
  2. Click Collect.
    A discover-support.[timestamp].zip file downloads to the local download directory.
  3. Attach the .zip file to your Tanium Support case form or send it to your TAM.

Tanium Discover maintains logging information in the discover.log file in the \Program Files\Tanium\Tanium Module Server\services\discover directory.

View Discover scan ranges

You might want to see the ranges that are scanned before you run discovery, or to troubleshoot discovery that has already run. To see the calculated gaps between the managed interfaces, use Discover Scan Range and Discover Scan Range - Unix sensors. The Discover Scan Range - Unix sensor is for Solaris and AIX platforms.

For example you might use the question: Get Computer Name and Operating System and Tanium Client IP Address and Discover Scan Range and Discover Scan Range - Unix from all machines. The results display the range between each of the managed endpoints and its forward and backward peers.

Why is the number of managed interfaces higher than the system status?

If you compare the number of managed interfaces in Discover, you might notice that the number is often higher than the number of Tanium Clients that are reported on the System Status page.

This disparity is expected. Interfaces are unique MAC addresses. One Tanium Client with multiple network interface controllers (NICs) displays as multiple interfaces in Discover.

Uninstall Discover

  1. From the Main menu, click Tanium Solutions. Under Discover, click Uninstall. Click Proceed with Uninstall to complete the process.
  2. Delete any remaining Discover-related scheduled actions and action groups.

  3. Check for Discover artifacts on your endpoints. Ask the question: Get Has Discover Artifacts = "true" from all machines. If any endpoints are returned by this question and you want to clean the artifacts off the endpoint, contact your TAM.
  4. If you have Tanium Server 7.2 and later: Check for Discover plugin schedules. From the Main menu, click Configuration > Common > Plugin Schedules. If plugin schedules exist for Discover, contact your TAM.

Last updated: 3/12/2019 2:49 PM | Feedback