Other resources

Release Notes

Performance overview

With Performance, you can monitor, investigate, and remediate endpoint performance problems.

Configure profiles to define events for specified computer groups. You can define event rules to monitor critical metrics related to hardware resource consumption, application health, and system health.

You can visualize the problems that have occurred across your environment and the commonalities between them on the Events page. Proactively solving problems increases end user productivity.

If you are troubleshooting an issue or find an endpoint to investigate further, use Tanium™ Direct Connect. There, you can view historical process-level data from a single endpoint. This data can help you quickly troubleshoot or understand the impact of software and hardware changes on performance.

Profiles and Events

Profiles define events for specified computer groups. For each profile, you can select computer groups to monitor and rules that determine when an event occurs.

Events are generated when an endpoint experiences the conditions that you defined in an event rule in a profile.

When a profile targets an endpoint, tools are distributed to that endpoint to collect and monitor performance data. Data is collected every 15 seconds and stored for one week. This local data store is queried when you analyze events in Performance.

For example, you might want to know when available memory falls below a certain threshold on specific computers. You can create a profile with an Available Memory is less than 250 MB event rule and set the target for that profile to a computer group you want to monitor. When you analyze events in Performance, memory events are reported if any endpoints that you are targeting had less than 250 MB of available memory during the time frame (scope) that you selected for analysis.

The Events page displays charts that provide a high-level overview of events in the environment. You can also see a list of the specific endpoints that experienced a particular event (such as low memory) to identify and investigate issues in your environment. For more information, see Analyzing events.

Event rules

Event rules determine what conditions cause targeted endpoints to report events. Performance includes these event rules:

  • CPU Critical
  • Available Memory
  • Disk Capacity
  • Disk Latency
  • Application Crashes

You can select heuristics for each event rule. For example, if you add the Disk Latency event rule, you can monitor Read Latency or Write Latency. If either heuristic is reached, the event rule is triggered.

For more information, see Reference: Event rules.

Direct Connect

Use Direct Connect to connect directly to a particular endpoint to troubleshoot an issue. For more information, see Connecting directly to endpoints.

Last updated: 10/22/2019 9:15 AM | Feedback