Troubleshooting Interact

If you encounter unexpected behavior, there are a few basic troubleshooting steps.

View and copy the Local Error Log

The Tanium Console maintains an error log on the local host computer for your web browser. It includes details on the last 100 errors that were returned to the Console in response to actions that you performed through the browser. For example, the log records errors that are associated with attempting to save a configuration or import a content file. The Console maintains a separate log for each browser that you use.

  1. In the Main menu, click User and select Local Error Log.
  2. (Optional) Expand Expand a log entry and click Copy Copy to copy the log details to the clipboard.
  3. (Optional) Click Clear Log if you want to remove all the log entries. For example, you might want to remove the entries after you finish resolving the associated issues.

Collect Interact logs

To send information to Tanium Support for troubleshooting Tanium Interact, perform the following steps to collect logs and other relevant information. The information is saved as a ZIP file that you can download through your browser.

  1. From the Interact Overview page, click Help .
  2. In the Troubleshooting section, click Download Support Package.
    A tanium-interact-support-<date-time>.zip file downloads to the local download directory.
  3. Attach the ZIP file to your Tanium Support case form or send it to Tanium Support.

Troubleshoot question runtimes

If Tanium Clients answer a question slower than expected, the question might use sensors that have long runtimes. The Tanium Console displays runtime indicators to show the average runtimes of sensors that you select for questions. If necessary, you can customize the thresholds that determine which indicator appears for a specific runtime. See Tanium Console User Guide: Managing sensor runtime thresholds.

Troubleshoot question results issues

If Tanium Clients do not answer questions, review the following issues and remediation tasks:

Question results issues
Issue Remediation
No results

The Question Results grid displays [no results] to indicate that a Tanium Client was instructed to answer but does not have a value that matches the sensor filter. This occurs if you apply a filter to the get clause and not the from clause. For example, if the question is Get IP Address ending with 2 from all machines, all endpoints return answers and all endpoints without an IP address ending in 2 return [no results].

Add the filter in the from clause. For example, Get IP Address from all machines where IP Address ends in 2 does not return unexpected [no results] rows.

You might also see [no results] if the sensor does not return a value or cannot execute the script.

Current result unavailable If an endpoint takes longer than usual to evaluate a sensor, it might initially supply the answer [current result unavailable] to the answer message that it passes along the linear chain and ultimately to Tanium Cloudthe Tanium Server. However, the sensor process continues on the endpoint after supplying that initial answer and, upon completing the process, the endpoint sends its updated answer. Tanium CloudThe Tanium Server then updates the Question Results grid.
Results currently unavailable The Question Results grid displays [results currently unavailable] to indicate that Tanium Cloudthe Tanium Server cannot correctly parse an answer. Contact Tanium Support if this occurs.
Too many results The Question Results grid displays [too many results] to indicate that more results are available, but the Tanium Clients will not return the additional results. Tanium CloudThe Tanium Server has certain checks to limit the network and memory impact of questions. Because of how these messages are generated, you cannot drill down on this response. To avoid this message, uses sensors that are more focused, or target only a certain endpoint or computer group to limit the unique number of strings for each answer.
TSE-Error

Messages that begin with [TSE-Error indicate a Tanium Client is in a state that prevents it from answering the question. Common reasons include:

Computer groups

Troubleshoot computer group assignments and configurations. You can see question results only for the computer groups that are assigned to the user account or persona that you use to issue questions.

Tanium Client communication View the status of client connections and, if necessary, correct them. See Tanium Client Management User Guide: Troubleshooting Tanium Clients and Client Management.

Troubleshoot action deployment issues

To ensure actions deploy as expected and to troubleshoot deployment issues, see Tanium Console User Guide: Monitor actions.

Uninstall Interact

If you need to uninstall Interact, perform the following steps.

  1. Sign in to the Tanium Console as a user with the Administrator role.
  2. From the Main menu, select Administration > Configuration > Solutions.
  3. In the Interact tile, click Uninstall Uninstall.

To reinstall Interact, see Installing Interact.

Contact Tanium Support

To contact Tanium Support for help, sign in to https://support.tanium.com.