Troubleshooting Performance

To collect and send information to Tanium for troubleshooting, collect log and other relevant information.

Collect logs

The information is saved as a compressed ZIP file that you can download with your browser.

  1. From the Performance Overview page, click Help , then the Troubleshooting tab.
  2. Collect the troubleshooting package. Click Generate Support Package. When the ZIP file is ready, click Download Support Package.
  3. Contact Tanium Support to determine the best option to send the ZIP file. For more information, see Contact Tanium Support.

Check the Trends client

If you do not see the Performance board when you attempt to import it from the Trends gallery, check the status of the Trends client in Performance. Click Info on the Performance Overview page, and check the Trends Client section to see whether the Trends client is started.

Monitor and troubleshoot Performance Coverage

The following table lists contributing factors into why the Performance coverage metric might report endpoints as Needs Attention or Unsupported, and corrective actions you can make.

Contributing factor Corrective action
Endpoints do not have a Performance profile installed

In Interact, ask the Get Performance - Configured from all machines question. The results from this question will tell you why an endpoint was classified as Needs Attention.

 

If the status for the endpoint is Needs Profile, check that the computer groups in your profiles cover all of the endpoints that you want to monitor.

Endpoints do not have the Performance tools installed

In Interact, ask the Get Performance - Configured from all machines question. The results from this question will tell you why an endpoint was classified as Needs Attention.

 

If the status for the endpoint is Needs Tools, ensure that all operating systems supported by Performance are included in the Performance and Direct Connect action groups. Membership in these action groups determines which endpoints receive the Performance and Direct Connect tools, which are required for Performance operations.

Endpoints do not have a supported version of the Tanium Client installed

In Interact, ask the Get Performance - Configured from all machines question. The results from this question will tell you why an endpoint was classified as Needs Attention.

If the status for the endpoint is Not Configured with details that state Needs Tanium Client Upgraded, upgrade the Tanium Client on the endpoint to a version that is supported by Performance. For a list of supported versions, see Requirements.

Endpoints do not have enough free disk space

In Interact, ask the Get Performance - Configured from all machines question. The results from this question will tell you why an endpoint was classified as Needs Attention.

If the status for the endpoint is Not Configured with details that state Needs More Disk Space, free up disk space on the endpoint. A minimum of 500 MB of free disk space is required.

The Tanium TSDB is disabled on the endpoint

In Interact, ask the Get Performance - Configured from all machines question. The results from this question will tell you why an endpoint was classified as Needs Attention.

If the status for the endpoint is Not Configured with details that state that Tanium TSDB is disabled, check to confirm that the endpoint is currently targeted by a profile. If the endpoint is currently targeted by a profile, but the Performance - Configured sensor still reports that Tanium TSDB is disabled on the endpoint, contact Tanium Support for assistance. For more information, see Contact Tanium Support.

Endpoints are not running a supported operating system

In Interact, ask the Get Performance - Configured from all machines question. If the result of this question is Unsupported, the endpoint operating system is not supported by Performance.

For a list of supported operating system versions, see Supported Operating Systems.

Monitor and troubleshoot Endpoints with Critical Performance Events

The following table lists contributing factors into why the endpoints with critical performance events metric might be higher than expected, and corrective actions you can make.

Contributing factor Corrective action
Resource intensive software
  • Consult the vendor.
  • Investigate other software interference (security software exclusions).
  • Investigate commonalities in software versions on affected machines.
Poorly performing hardware Consider replacing the models or upgrading their hardware.
Event thresholds poorly defined Consider raising thresholds and durations in one or more profiles.
System Crashes
  • Check for out-of-date driver versions.
  • Research causes of numerous bugcheck IDs.
  • Out of date BIOS or Firmware versions.
  • Out of date or known bad kernel-mode drivers.
  • Faulty hardware.
Low Disk Capacity
  • Investigate what is using disk space.
  • Free up disk space.
  • Increase disk space available to users.
    • Expand virtual volumes.
    • Upgrade disks in physical machines.
Application Crashes
  • Consult the software vendor
  • Use the file browser in Direct Connect sessions to retrieve log or dump files and investigate them.

Uninstall Performance

  1. From the Main menu, go to Administration > Configuration > Solutions.
  2. In the Performance section, click Uninstall.
  3. Review the content that will be removed and click Uninstall.
  4. Enter your credentials and click OK to start the uninstall process.
  5. Return to the Solutions page and verify that the Import button is available for Performance.

By design, the uninstall process does not remove Performance content (packages, saved questions, and sensors) so that other solutions are not impacted if they use this content. If you are sure that this content is not being used by any other solutions, you can manually remove it.

Contact Tanium Support

To contact Tanium Support for help, send an email to [email protected].