Troubleshooting the Tanium Client on a single endpoint

In Reporting or Interact, you can quickly download log files, action history, and other useful troubleshooting data from a single endpoint.

Download log files, action history, and access logically grouped bundles of logs and other artifacts, sometimes referred to as an Endpoint Must Gather (EMG) from the Client Management tab. You access the Client Management tab on the Endpoint Details page. For information on accessing the Endpoint Details page, see Tanium Reporting User Guide: View endpoint details.

Logs and actions

Use the Client Management tab to download log files and action history from an endpoint. the Review Tanium Client logs to help you troubleshoot client issues. For example, a client might not answer questions or appear in the Tanium Console (Administration > Configuration > Client Status) because that client cannot connect to the Tanium Server or Zone Server. In this case, you can review the client logs to determine whether the connection failed due to an invalid server IP address, DNS resolution failure, missing Tanium public key file, or firewall rule. For more information on Tanium Client logs, see Tanium Client Management User Guide: Access individual endpoint logs in Client Management.

When a package does not seem to work after you deploy it through an action, review action logs and the files associated with the action to help troubleshoot. Each time the Tanium Client receives an action message with an instruction set to execute, the client creates an action log file named Action_<ID>.log, where <ID> is the action identifier. The action log contains the CLI output associated with the action command. The Tanium Client stores any files that are required to deploy an action package in Action_ID directories. For more information on action history, see Tanium Client Management User Guide: Review action logs and associated files to troubleshoot actions and packages .

Download client logs

From the Logs panel on the Client Management tab, select a log file to view or download the contents. Click Download to download the contents to the download location of the web browser.

Download action history

From the Actions panel on the Client Management tab, select a log file to view or download the contents. Click Download to download the contents to the download location of the web browser.

Gather

Use the Client Management tab to collect a bundle of logs and other artifacts, sometimes referred to as an Endpoint Must Gather (EMG).

From the Available Steps panel in the Client Management tab, select one or more available steps for which you want to gather troubleshooting information. Available steps are grouped by domain, which corresponds to a Tanium solution area to which the troubleshooting information is relevant.
Click Gather from Endpoint. The available steps that you selected display in the Must Gathers panel. When the value of the result column for each available step you select displays as Complete, you can download the troubleshooting information for that available step.
From the Must Gathers panel, select one or more completed available steps, and click Download to download the contents to the download location of the web browser.

For more information on collecting troubleshooting information from endpoints, see Tanium Client Management User Guide: Collect troubleshooting information from endpoints .