Reference: Endpoint monitoring status errors

Standard cross platform endpoint status error messages

IM Process - Error: IM Process potentially hung

The Integrity Monitor process has not written to the database recently. The “Integrity Monitor Endpoint Process Start” action will automatically restart the process if it gets stuck in this state.

IM Process - Error: IM Process not running

This message is normal for a short period of time after a reboot or after deploying the “Integrity Monitor - Tools [Windows]” package. “Integrity Monitor Endpoint Process Start” action will automatically correct this issue.

IM Process - Error: IM Process is disabled

The Integrity Monitor process has been manually disabled. It can be re-enabled it using the “Integrity Monitor Enable or Disable Endpoint Process [OS]” packages.

Index - Error: Tanium Index is not running

Index is not running. This message will only be reported if the monitor is in event mode or hybrid mode (using both event monitoring and hash monitoring).

Recorder - Error: Recorder not installed
Install Needed: Recorder not installed

Both messages are generated at the same time. Recorder needs to be installed.

Recorder - Error: Error getting results from recorder DB

An exception occurred trying to gather data from the recorder’s DB.

Recorder - Error: Missing the recorder database file monitor.db

The recorder will generate this file when it runs. This error should resolve itself when recorder runs again.

Recorder - Error: Event recorder is not running

The recorder process is not running. This message will only be reported if the monitor is in event mode.

Recorder - Error: Missing the recorder database file monitor.db

The recorder has been manually disabled.

Standard Windows-specific endpoint status error messages

Recorder - Error: Missing "TaniumSystemMonitor" from Event Tracing sessions
Install Needed: Missing "TaniumSystemMonitor" from Event Tracing sessions

The recorder is not registered with the Windows ETW. No events will be recorded. Both messages are emitted at the same time.

Recorder - Error: Event Tracing for Windows checks timed out

Checking on Event Tracing for Windows (ETW) failed. There probably are issues with ETW and recorder is likely missing events.

Standard Linux-specific endpoint status error messages

Recorder - Error: im_recorder.json file not found
Install Needed: im_recorder.json file not found

A needed configuration file for recorder is missing. Redeploy “Integrity Monitor - Tools [Linux]” to add it. Both messages are emitted at the same time.

Recorder - Error: Disabled due to the CPU usage exceeding the threshold of X%

The recorder is disabled because it used more than the configured CPU limits for too long. Note that X is the threshold configured on the endpoint.

Recorder - Error: Failed to extract cpuThreshold: Error <Detailed Error Message>

An exception occurred trying to get the cpuThreshold from recorder.

Recorder - Error: The "service" binary is not installed on this system. Please install it first.

The system is missing the standard Linux ‘service’ binary. This needs to be installed for recorder to run.

Recorder - Error: Auditd is not installed on this system. Please install first.

The system is missing auditd. This needs to be installed for recorder to run.

Recorder - Error: Trouble loading recorder audit rules ("key=TaniumRecorder" missing from "auditctl -l" output)

Recorder auditd rules are not configured correctly so the recorder will not get any events.

Integrity Monitor - Error: Python Core Library for Tanium not installed
Tools Install Required: Python Core Library for Tanium not installed

The Python Core Library for Tanium is missing. Deploy the latest tools to pick it up.

Tools Install Required: Missing updated status sensor

Deploy the latest tools to pick up the status sensor.

Last updated: 6/20/2019 4:58 PM | Feedback