Troubleshooting Map

To collect and send information to Tanium for troubleshooting, collect logs and other relevant information.

Collect logs

You can save a Map troubleshooting package as a compressed ZIP file.

  1. From the Map Home page, click Help , then the Troubleshooting tab.
  2. Click Collect.
  3. When the status shows as Collected, click Download . A map-support.[timestamp].zip file downloads to the local download directory.
  4. Attach the ZIP file to your Tanium Support case form or send it to your TAM.

Tanium Map maintains logging information in the Map.log file in the <Tanium Module Server>/services/Map directory.

Capture map state

To send data about your maps to Tanium for troubleshooting, you can enable state capture on the map. When enabled, you can get a JSON file to send to Tanium for troubleshooting.

  1. From the Map Home page, click Settings , then the Map Display tab.
  2. Select Enable Map State Capture and save the settings.
  3. When you open a map, click Capture to save and download information about the map in a JSON file. This file is only useful for Tanium TAMs and development for troubleshooting purposes.

View health of Map components

On the Map Home page, scroll to the Health section. Click Interact to view more specific information. Consider contacting your TAM if any of the health status reports display a bad state for more than a day.

Change size of endpoint database

By default, the endpoint database maximum size is 1 GB. To change the maximum size, go to the Map Home page and click Settings . Update the Max Endpoint Database Size.

Start or stop the recorder

You might need to manually start or stop the recorder. The recorder does not restart automatically.

For example, if the database size or CPU usage limits are exceeded, the recorder is automatically stopped. Resolve the underlying issue and restart the recorder. Or, if you find that the recorder is using more system resources than expected, you can stop the recorder and troubleshoot the issue.

  1. Use a question to target the affected endpoints. For example, ask Get Map - Status contains recorder from all machines.
  2. Drill down to the specific endpoints.
  3. To disable the recorder, deploy the Map - Disable Event Recording [Windows-Mac-Linux] package as an action.
  4. To enable the recorder again, deploy the Map - Enable Event Recording [Windows-Mac-Linux] package as an action.

For more information, see the Tanium Console User Guide: Managing and creating Packages or the Tanium Interact User Guide: Using Deploy Action.

Problem: Map data is not displaying

From the map, click Interact to view the results of the question that was used to generate the map. Click Refresh Data to update the data that is showing in the map if necessary.

Problem: Application discovery is taking a long time per tier

When you are running application discovery, a few nodes in each tier might take a long time to respond. You can configure a timeout for application discovery time spent on each tier.

  1. From the Map Home page, click Settings , then the Application Discovery tab.
  2. Edit the Discovery Timeout setting and save your changes.

Uninstall Map

  1. From the Main menu, click Tanium Solutions.
  2. Under Map, click Uninstall. Click Proceed with Uninstall to complete the process.
  3. Remove Map Tools from your endpoints. To see which endpoints have the map tools installed, ask the question: Get Computer Name and Map - Tools Version from all machines with Map - Tools Version contains Package Installed. If you want to clean the artifacts from your endpoints, contact your TAM.

  4. A backup map-files folder gets created on the Module Server as part of the uninstall process. You can keep or delete this folder. If any other Map artifacts remain on your Module Server, contact your TAM.

  5. Remove Map saved questions. You can remove saved questions that meet all the following conditions:

    • Owned by the service account you configured for Map

    • AND the name of the saved question starts with Map

    • AND is in the Map content set

  6. Remove the Map scheduled actions:

    • Map - Distribute Application Catalog [Windows]
    • Map - Distribute Application Catalog [Mac]
    • Map - Distribute Application Catalog [Linux]
    • Map - Distribute Tools [Windows]
    • Map - Distribute Tools [Mac]
    • Map - Distribute Tools [Linux]
    • Map - Distribute Update Endpoint Data [Windows]
    • Map - Distribute Update Endpoint Data [Mac]
    • Map - Distribute Update Endpoint Data [Linux]
  7. Remove the Map action group. After the action group is empty, you can delete the Tanium Map action group.

Last updated: 10/29/2019 3:12 PM | Feedback