If you encounter unexpected behavior with Trends, use the information contained here to troubleshoot the issue.
If data is not collected and populated in boards and panels as expected, check the following pages to verify that Trends saved questions are being issued, and that the questions return results.
- From the Main menu, go to Administration > Content > Question History and review the log of Trends saved questions.
- From the Trends menu, click Sources to open the Sources page. Make sure the source for the panel is not disabled. A icon indicates the source is disabled.
- From the User Defined tab on the Sources page, click a saved question source to view details on the source. The Runs tab contains logs that show if Trends is able to successfully collect data from the endpoints.
In environments that enable role-based access control (RBAC), users cannot access content to which they do not have permission. Sensors, sources, and boards are among those objects that are managed through RBAC. If you are unable to access sensors, sources, or boards in Trends, make sure your user account has sufficient permission to the content sets to which those objects are assigned.
- You must have read permission to the content set to view content in the content set. For example, if you do not have read permission to Patch sensors, you will not see Patch sensors as options when building a Trends source.
- You must have write permission to a content set to add, edit, or delete content in the content set. For example, if you do not have the Trends API Board write permission to a content set, you cannot edit any boards that are assigned to that content set.
- To see data on a board, you must have the Trends API Board read permission to the content set that contains the board, and the Trends Data read permission to the content sets that contain the sources for the panels that appear on the board.
If you need to contact Tanium Support to troubleshoot an issue with Trends, you may need to provide your version of Trends and how much disk space Trends uses.
From the Trends Overview page, click Information . The version information and storage size appear in the About tab.
If you encounter issues that you want to troubleshoot with the assistance of Tanium™ support, you can create a package of database logs, Trends service logs, and configuration files that can be used to diagnose unexpected behavior.
To download logs:
- From the Trends Overview page, click Help .
- On the Troubleshooting tab, click Create Package.
- After the support bundle is created, click the download button to retrieve the ZIP file.
A zip file that contains the log file downloads to your browser's download folder.
In addition to any database logs, Trends stores up to the latest 20 Trends service logs. Each service log can contain 10 MB maximum of data, and the total size of all service logs will not exceed 20 MB.
You can find logs on the Module Server at <Module Server>\services\trends-files\logs.
If the Trends service cannot be reached from the Tanium Console, Trends functionality is not available and a message appears. If the problem persists, contact Tanium Support.
When you uninstall Trends, any collected data is saved by default so that you can restore the data if you later decide to reinstall Trends. In some cases, you might want to start "clean" and not restore the data. To do this, you must manually uninstall some files.
Consult with Tanium Support before you uninstall or reinstall Trends.
What happens when you uninstall Trends?
When you uninstall Trends, the Tanium Console removes:
- Trends workbench
- Trends-related configuration objects (boards, panels, and saved question sources)
- Trends service
To support data restoration, the uninstallation procedure does not remove:
- Collected data at <Tanium Module Server>\services\trends-files\
- Trends saved questions (which continue to be reissued)
- Trends module sources (which are removed when you uninstall the corresponding Tanium solutions)
- Trends content sets
Uninstall Trends so data is restored when you reinstall
- Sign in to the Tanium Console as a user with the Administrator role.
- From the Main menu, go to Administration > Configuration > Solutions.
- Under Trends, click Uninstall.
- Review the summary and click Uninstall.
- When prompted to confirm, enter your password and click OK.
If you later install Trends, the previous data and sources are restored.
In an Active-Active deployment, the Trends workbench and Trends menu remain on the cluster member on which the uninstallation was not run. The Trends workbench must be manually removed from that instance. Contact Tanium Support for assistance. For information about Active-Active deployments, see Tanium Core Platform Install Guide: Installing Tanium Server in an Active-Active cluster.
Uninstall Trends so you start fresh when you reinstall
- Uninstall Trends as described in the previous section.
- Manually delete the following:
- Trends files at <Tanium Module Server>\services\trends-files\
- Trends saved questions (through Administration > Content > Saved Questions)
If you later install Trends and import the gallery, no data collected for saved question sources is preserved from previous installations.
To contact Tanium Support for help, sign in to https://support.tanium.com.
Last updated: 1/7/2022 9:27 AM | Feedback