Reference: Endpoint monitoring status errors

Standard Windows endpoint status error messages

Error: Redeploy "Integrity Monitor Endpoint Tools [Windows]", as the endpoint resident status sensor code is outdated (minimum required version = <version>)

[Recorder] The Tools Status sensor is not able to run because files on the endpoint are out-of-date. Redeploy monitors to remedy.

Install needed

[Recorder] Need to deploy monitors so the tools are installed to start recording events.

Error: Tanium Index config.ini not found

[Legacy] The Tools Status sensor was not able to find Tanium Index's config.ini file.

Error: Tanium Index initial scan is Not complete

[Legacy] IM events will not be recorded until after Index's initial scan has completed.

Error: Tanium Index is Not running

[Legacy] IM events will not be recorded if Index is not running.

Platform is Not Supported

[Recorder and Legacy] The endpoint does not support IM. This means that either the endpoint OS is too old to support the Event Recorder, or it supports Legacy Mode, but does not have Index installed.

Redeploy "Integrity Monitor Endpoint Tools [Windows]" package, one or more incompatible endpoint resident libraries were found (minimum required version = <version>)

[Recorder] An out-of-date file was found on the endpoint. Redeploy monitors to remedy.

Error: Minimum client version requirement not met

[Recorder] Will prevent Windows Recorder from starting or recording events. Update Tanium Client to the required version as listed in Tanium dependencies.

Error: Failed to get status of file permission auditing: <error>

[Recorder] A system error occurred when attempting to get file permission auditing status.

Error: Minimum configured disk space requirements not met

[Recorder] Will prevent Windows Recorder from recording events. The Recorder has a 1Gb requirement. Due to backup operations, this means requirement is doubled, so 2GB is needed. Clear up disk space to start recording again.

Error: Missing the recorder database file, monitor.db

[Recorder] The recorder is presumably running, but no database file was found.

Error: Missing <filename>

[Recorder] Will prevent monitor saved questions from retrieving events from this endpoint. Deploy monitors to resolve the missing file.

Error: File: <filename>: version <version> found: <requiredVersion> required

[Recorder] Recording will continue on the endpoint, but saved question will not be able to get events from the endpoint. Deploy monitors to resolve the version issue.

Error: Missing "TaniumSystemMonitor" from Event Tracing sessions

[Recorder] The recorder is not registered with the Windows ETW. No events will be recorded.

Error: Missing the following Event Tracing providers <provider1>,<provider2>,...

[Recorder] Required event providers were not found. Events from those providers will not be recorded.

Standard Linux endpoint status error messages

Missing Python for Endpoints component - Python binary

Missing Python for Endpoints component - shared object files

Python for Endpoints not installed

Python Core Libraries not installed

Tanium Python for Endpoints is missing. Redeploy monitors to remedy.

Install Needed

Need to deploy monitors so that endpoint tools are installed and events can be recorded.

Platform is Not Supported

The endpoint does not support Integrity Monitor.

Failed to import endpoint resident Integrity Monitor Endpoint Tools status sensor code

An error occurred loading the endpoint resident portion of the tools status sensor. Redeploy monitors to remedy.

Recorder is disabled

The endpoint recorder is currently disabled and not recording events. To reenable, deploy the Integrity Monitor Toggle Endpoint Recorder [Linux] to the endpoint.

Error: Missing <filename>

Error: Invalid binary file: <filename>

Error encountered when getting version for <filename>

Error: <filename> version <found version> found (checked against expected version <expected verison>)

A required file was not found, was invalid, or was not correct version. Redeploy monitors to remedy.

Error: No maxSizeMB value found in recorder config file

No maximum recorder database size setting was round in the recorder config file. Therefore, disk space requirements cannot be checked. Redeploy monitors to remedy.

Cannot find a line with the key-name "log_format" or "write_logs" in <auditd_config_file>. Please check this file.

Key <key_name> has no value in auditd.conf file

Unable to determine the status of auditd logging on the endpoint. Please check the auditd configuration on the endpoint.

The package Integrity Monitor Endpoints Tools package needs to be installed

Redeploy monitors to remedy.

Error: Trouble loading recorder audit rules ("key=TaniumRecorder" missing from "auditcl-l" output)

The required auditd rules for the recorder were not found in the auditd rules file. Redeploy monitors to remedy.

Last updated: 7/31/2018 1:26 PM | Feedback