Troubleshooting Trends

If you encounter unexpected behavior with Trends, use the information contained here to troubleshoot the issue.

Collect logs

The information is saved as ZIP files that you can download with your browser.

To download logs:

  1. From the Trends Overview page, click Help .
  2. From the Troubleshooting tab, select the solutions for which to gather troubleshooting packages and click Create Packages.
    By default, all solutions are selected.
  3. When the packages are ready, click Download Support Bundle.
    ZIP files of all the selected packages download to the local download directory.

    Some browsers might block multiple downloads by default. Make sure to configure your browser to permit multiple downloads from the Tanium Console.

  4. Contact Tanium Support to determine the best option to send the ZIP files. For information, see Contact Tanium Support.

In addition to any database logs, Trends stores up to the latest 20 Trends service logs. Each service log can contain 10 MB maximum of data, and the total size of all service logs will not exceed 20 MB.

You can find logs on the Module Server at <Module Server>\services\trends-files\logs.

Basic tips

If data is not collected and populated in boards and panels as expected, check the following pages to verify that Trends saved questions are being issued, and that the questions return results.

  • From the Main menu, go to Administration > Content > Question History and review the log of Trends saved questions.
  • From the Trends menu, click Sources to open the Sources page. Make sure the source for the panel is not disabled. A icon indicates the source is disabled.
  • From the User Defined tab on the Sources page, click a saved question source to view details on the source. The Runs tab contains logs that show if Trends is able to successfully collect data from the endpoints.

Unable to view or select content

In environments that enable role-based access control (RBAC), users cannot access content to which they do not have permission. Sensors, sources, and boards are among those objects that are managed through RBAC. If you are unable to access sensors, sources, or boards in Trends, make sure your user account has sufficient permission to the content sets to which those objects are assigned.

  • You must have read permission to the content set to view content in the content set. For example, if you do not have read permission to Patch sensors, you will not see Patch sensors as options when building a Trends source.
  • You must have write permission to a content set to add, edit, or delete content in the content set. For example, if you do not have the Trends API Board write permission to a content set, you cannot edit any boards that are assigned to that content set.
  • To see data on a board, you must have the Trends API Board read permission to the content set that contains the board, and the Trends Data read permission to the content sets that contain the sources for the panels that appear on the board.

Upgrading to Trends 3.9

In Trends 3.9, the steps required to configure the service account are no longer necessary due to the adoption of System User Service, which performs these tasks automatically. Additionally, the Trends database is migrated to RDB Service in this release. Consequently, after upgrading to Trends 3.9, it might take time for the database migration to complete and for RBAC privileges and other updates to sync properly. This could lead to issues and error messages when you first query the Tanium Console. These issues should resolve on their own after a few minutes, but could take up to an hour or longer depending on system resources and the amount of data to migrate.

Version and disk usage details

If you need to contact Tanium Support to troubleshoot an issue with Trends, you may need to provide your version of Trends and how much disk space Trends uses.

From the Trends Overview page, click Information . The version information and storage size appear in the About tab.

Service unavailable

If the Trends service cannot be reached from the Tanium Console, Trends functionality is not available and a message appears. If the problem persists, contact Tanium Support.

Uninstall Trends

When you uninstall Trends, any collected data is saved by default so that you can restore the data if you later decide to reinstall Trends. In some cases, you might want to start "clean" and not restore the data. To do this, you must manually uninstall some files.

Consult with Tanium Support before you uninstall or reinstall Trends.

What happens when you uninstall Trends?

When you uninstall Trends, the Tanium Console removes:

  • Trends workbench
  • Trends-related configuration objects (boards, panels, and saved question sources)
  • Trends service

To support data restoration, the uninstallation procedure does not remove:

  • Collected data at <Tanium Module Server>\services\trends-files\
  • Trends saved questions (which continue to be reissued)
  • Trends module sources (which are removed when you uninstall the corresponding Tanium solutions)
  • Trends content sets

Uninstall Trends so data is restored when you reinstall

  1. Sign in to the Tanium Console as a user with the Administrator role.
  2. From the Main menu, go to Administration > Configuration > Solutions.
  3. Under Trends, click Uninstall.
  4. Review the summary and click Uninstall.
  5. When prompted to confirm, enter your password and click OK.

If you later install Trends, the previous data and sources are restored.

In an Active-Active deployment, the Trends workbench and Trends menu remain on the cluster member on which the uninstallation was not run. The Trends workbench must be manually removed from that instance. Contact Tanium Support for assistance. For information about Active-Active deployments, see Tanium Core Platform Install Guide: Installing Tanium Server in an Active-Active cluster.

Uninstall Trends so you start fresh when you reinstall

  1. Uninstall Trends as described in the previous section.
  2. Manually delete the following:
    • Trends files at <Tanium Module Server>\services\trends-files\
    • Trends saved questions (through Administration > Content > Saved Questions)

If you later install Trends and import the gallery, no data collected for saved question sources is preserved from previous installations.

Contact Tanium Support

To contact Tanium Support for help, sign in to https://support.tanium.com.