Troubleshooting Map

To collect and send information to Tanium for troubleshooting, collect logs and other relevant information.

Tanium Cloud is a self-monitored service, designed to detect failures before the failures surface to users. For more information, see Tanium Cloud Deployment Guide: Troubleshooting Tanium Cloud.

Identify Linux endpoints that are missing auditd

If Linux endpoint events are not being recorded, they might be missing the audit daemon and audispd services. Ideally, the audit daemon is installed and configured before installing the Map module, but it is possible for endpoints to come online at a later time.

1. (Optional) Create the auditd package.

   You can either create a general installation package and put the logic in the scripts or you can have a simple script and put the logic in the Tanium query. See Tanium Core Platform User Guide: Creating and managing packages.

2. Ask the question: Get Installed Application Exists[audit] from all machines with Is Linux containing "true".

3. Deploy the appropriate auditd package to the identified endpoints.

   If you need to distribute the package to a large number of endpoints, spread the changes out over time to avoid a negative impact on the network.

View health of Map components

On the Map Overview page, go to the Health section. You can view any issues that exist on the endpoints, and the status of the Map tools.

Resolve issues with legacy Client Recorder Extension installations

If Tanium Endpoint Configuration detects endpoints that have legacy versions of the Client Recorder Extension installed, it reports the endpoint as Unsupported in the recorder column of the results grid when you ask the question: Get Endpoint Configuration - Tools Status. If Client Recorder Extension version 1.x exists on a targeted endpoint, you must remove it before you install Client Recorder Extension version 2.x tools. To target endpoints where Client Recorder Extension version 1.x exists, ask the question: Recorder - Legacy Installed. If the Supported Endpoints column displays Yes, you must remove Client Recorder Extension version 1.x from the endpoint before you install Client Recorder Extension 2.x tools. To remove Client Recorder Extension version 1.x, deploy the Recorder - Remove Legacy Recorder [Operating System] package to targeted endpoints.

File, network, or security events are not displayed on Oracle Linux server

If you are not seeing file, network, or security events in the recorder results, you can disable SELinux. When SELinux is enabled and the auditd fallback is disabled on Oracle Linux, only process information is returned. Alternatively, ensure that the Client Recorder Extension configuration parameters are set as follows:

• CX.recorder.AuditdStopAuditdService is set to 0.
• CX.recorder.AuditdEnableAudispdFallback is set to 1.

For more information, see Client Recorder Extension User Guide: Configuring recorded events .

Monitor and troubleshoot Map Coverage Status

The following table lists contributing factors into why the Map Coverage Status metric might be lower than expected, and corrective actions you can make.

Contributing factor	Corrective action
Tools not deployed	Verify Tanium Clients are current and supported. For a list of supported Tanium Client versions with Map, see Map requirements. Verify that intended targets are in the appropriate Map action groups. See Installing Map Configure Map action group.
Recorder health	Verify the Tanium Driver is in use for Windows systems. See Installing Map Windows systems. Make sure auditd is set to not log. See Installing Map Linux systems. Ensure sufficient drive space is available. Up to 200 MB of free disk space might be required for the Map database. Review the results of the Client Extensions - Status sensor for any health check findings that might need to be addressed.
CX health	Review the results of the Client Extensions - Status sensor to determine appropriate areas to focus remediation efforts. Verify that endpoints meet the requirements for application discovery. See Step 2: Configure endpoints for discovery.

Monitor and troubleshoot Servers Mapped to an Application

The following table lists contributing factors into why the Servers Mapped to an Application metric might be lower than expected, and corrective actions you can make.

Contributing factor	Corrective action
System serves as a standby	Increase the frequency of failover testing to ensure live traffic to all involved machines.
System was previously decommissioned but not retired	Use an endpoint map to determine if any legitimate traffic is taking place, then redirect the traffic accordingly. See Mapping endpoints.
System was brought online without appropriate authorization	Review system activity logs to determine current users and administrators.
System might be in a degraded state	Use Tanium to triage and diagnose the system and determine best course of action.

Remove Map tools from endpoints

You can deploy an action to remove Map tools from an endpoint or computer group. Separate actions are available for Windows and non-Windows endpoints.

1. In Interact, target the endpoints from which you want to remove the tools. For example, ask a question that targets a specific operating system:
   Get Endpoint Configuration - Tools Status from all machines with Is Windows equals true
2. In the results, select the row for Map, drill down as necessary, and select the targets from which you want to remove Map tools. For more information, see Tanium Interact User Guide: Drill Down.
   
3. Click Deploy Action.
4. For the Deployment Package, select Endpoint Configuration - Uninstall Tool [Windows] or Endpoint Configuration - Uninstall Tool [Non-Windows], depending on the endpoints you are targeting.

5. For Tool Name, select Map.

6. (Optional) By default, after the tools are removed they cannot be reinstalled. To allow tools to be automatically reinstalled, clear the selection for Block reinstallation. Re-installation occurs almost immediately.

   If reinstallation is blocked, you must unblock it manually:

   • To allow Map to reinstall tools, deploy the Endpoint Configuration - Unblock Tool [Windows] or Endpoint Configuration - Unblock Tool [Non-Windows] package (depending on the targeted endpoints).

   • If you reinstall tools manually, select Unblock Tool when you deploy the Endpoint Configuration - Reinstall Tool [Windows] or Endpoint Configuration - Reinstall Tool [Non-Windows] package.

7. (Optional) To remove all Map databases and logs from the endpoints, clear the selection for Soft uninstall.

   When you perform a hard uninstallation of some tools, the uninstallation also removes data that is associated with the tool from the endpoint. This data might include important historical or environmental data. If data that you want to keep is associated with the tool, make sure you perform only a soft uninstallation of the tool.

8. (Optional) To also remove any tools that were dependencies of the Map tools (such as Recorder and Index) that are not dependencies for tools from other solutions, select Remove unreferenced dependencies.

9. (Optional) In the Deployment Schedule section, configure a schedule for the action.

   If some target endpoints might be offline when you initially deploy the action, select Recurring Deployment and set a reissue interval.

10. Click Show preview to continue.

11. A results grid appears at the bottom of the page showing you the targeted endpoints for your action. If you are satisfied with the results, click Deploy Action.

If you have enabled Endpoint Configuration approval, tool removal must be approved in Endpoint Configuration before tools are removed from endpoints.

Contact Tanium Support

To contact Tanium Support for help, sign in to https://support.tanium.com.