Managing question and sensor thresholds
The time that a Tanium Client takes to run a question varies widely, based on which sensors, and how many, the question invokes. To assess the impact that running Tanium questions has on endpoint resources, you can customize the question and sensor runtime thresholds that trigger indicator icons in the Tanium Console.
Your user account requires the Administrator reserved role to see and use the Configuration > Sensor Thresholds page.
The Tanium Client tracks the runtime for each sensor when a question runs it, calculates the average of all the past runtimes for that sensor, and sends the updated runtime information to the Tanium Server every three hours. The Tanium Server calculates the average runtime based on the latest updates from all the endpoints that reported runtimes for the sensor.
The following table lists describes the threshold icons and their default labels and values.
When viewing threshold indicators, note the following caveats:
- The Tanium Server does not use cached responses to questions when calculating runtime averages.
- Sensors that require data sampling are more likely to exceed runtime thresholds. However, the longer runtimes required for sampling do not necessarily indicate high resource usage when endpoints run these sensors. Consult your TAM for details. The affected sensors include:
- CPU by Process
- CPU Consumption
- Disk IOPS
- High CPU Consumption
- High CPU Processes
- Network Throughput Inbound
- Network Throughput Outbound
- SQL Server CPU Consumption
- Tanium Client CPU
Work with your Technical Account Manager (TAM) to determine the runtime thresholds that you expect will influence administrator decisions about whether to run a question, how often to run it, and which sensors to include in the question. The goal is to plan questions in a way that does not interfere with other, more critical tasks that endpoints perform. The factors to consider are:
- The runtime for any question is the cumulative total of the average runtimes for all the sensors it includes. Therefore, the best practice is to set question thresholds higher than sensor thresholds.
- The best practice is to set thresholds that reflect decisions Tanium administrators must make, based on the endpoint management policies of your organization. For example, policies might dictate that administrators must never run a question that takes longer than 10 seconds during peak traffic times on endpoints that perform tasks with a higher priority than responding to questions.
The Tanium Console displays threshold indicators by default. However, you can change the default thresholds as follows.
- Go to Configuration > Common > Sensor Thresholds.
- Select whether you want the Tanium Console to Display thresholds to only those Tanium users with predefined administrative roles (Admin) or to all users who are allowed to see questions and sensors (Admin and Users).
- Enter a label for each threshold or accept the defaults: High, Medium, and Low.
- Set the average runtime (in milliseconds) for each threshold or accept the defaults.
- Save your changes.
Threshold indicator icons appear wherever you view and select questions or sensors in the Tanium Console. After modifying threshold values, verify that the Tanium Server applied your changes.
The Content > Sensors page displays runtime statistics for all sensors.
- Go to Interact.
- In the Ask a Question field, type a question that uses a sensor expected to have a short runtime, such as Computer Name, and a sensor expected to have a long runtime, such as Running Processes of User. For example: Get Computer Name and Running Processes Of User[admin] from all machines. Press Enter to display a list of suggested questions.
- Verify that the list of suggested questions displays the expected threshold icons. If you see unexpected indicators, review the icon descriptions and caveats described in Question and sensor thresholds overview.
- Hover over the icon for the suggested question that you want, and verify that the popup displays the expected runtime (in milliseconds) for the question and the expected threshold icons for its individual sensors.
Last updated: 9/19/2019 3:30 PM | Feedback