Managing sensor runtime thresholds
The time that a Tanium Client takes to run a question varies widely, based on which sensors, and how many, the question invokes. To
Your user account requires the Administrator reserved role to see and use the Administration > Configuration > Common > Sensor Thresholds page.
The Tanium Client tracks the runtime for each sensor when a question runs it, calculates the average of all the past runtimes for that sensor, and sends the updated runtime information to the Tanium Server every three hours. The Tanium Server calculates the average runtime based on the latest updates from all the endpoints that reported runtimes for the sensor.
The following table lists describes the threshold icons and their default labels and values.
When viewing threshold indicators, note the following caveats:
- The Tanium Server does not use cached responses to questions when calculating runtime averages.
- Sensors that require data sampling are more likely to exceed runtime thresholds. However, the longer runtimes required for sampling do not necessarily indicate high resource usage when endpoints run these sensors. Contact Tanium Support for details. The affected sensors include:
- CPU by Process
- CPU Consumption
- Disk IOPS
- High CPU Consumption
- High CPU Processes
- Network Throughput Inbound
- Network Throughput Outbound
- SQL Server CPU Consumption
- Tanium Client CPU
Work with your Tanium Support (see Contact Tanium Support) to determine the runtime thresholds that you expect will influence administrator decisions about whether to run a question, how often to run it, and which sensors to include in the question. The goal is to plan questions in a way that does not interfere with other, more critical tasks that endpoints perform.
Set thresholds that reflect decisions Tanium users must make, based on the endpoint management policies of your organization. For example, policies might dictate that users must never run a question that exceeds 10 seconds during peak traffic times on endpoints that perform tasks with a higher priority than responding to questions.
The Tanium Console displays threshold indicators by default. However, you can change the default thresholds as follows.
- From the Main menu, go to Administration > Configuration > Common > Sensor Thresholds.
- Select whether you want the Tanium Console to Display thresholds to only those Tanium users with predefined administrative roles (Admin) or to all users who are allowed to see questions and sensors (Admin and Users).
- Set the average runtime (in milliseconds) for each threshold (High, Medium, and Low) or accept the defaults, and then click Save.
The current release supports runtime indicators only for sensors. Ignore the Question runtime thresholds.
Threshold indicator icons appear wherever you view and select sensors in the Tanium Console. After modifying threshold values, verify that the Tanium Server applied your changes.
The Administration > Content > Sensors page displays runtime statistics for all sensors.
- Go to Tanium Home page or Interact Overview page.
- In the Explore Data field, type a question that uses a sensor expected to have a short runtime, such as Computer Name, and a sensor expected to have a long runtime, such as Running Processes of User. For example: Get Computer Name and Running Processes Of User[admin] from all machines. Press Enter to display a list of suggested questions.
- Verify that the list of suggested questions displays the expected threshold icons. If you see unexpected indicators, review the icon descriptions and caveats described in Sensor runtime thresholds overview.
- Hover over the icon for the suggested question that you want, and verify that the popup displays the expected runtime (in milliseconds) and the expected threshold icons for each sensor.
Last updated: 10/20/2020 8:59 AM | Feedback