Performance overview

With Performance, you can monitor, investigate, and remediate endpoint performance problems.

Configure profiles to define events for specified computer groups. Define event rules to monitor critical metrics related to hardware resource consumption, application health, and system health.

Visualize the problems that have occurred across your environment and the commonalities between them on the Events page. Proactively resolving these problems can improve end-user productivity.

To troubleshoot an issue with a single endpoint, use Tanium™ Direct Connect. There, you can view live and historical process-level data from a single endpoint. Use this data to troubleshoot or understand the impact of software and hardware changes on performance.

Profiles and Events

Profiles define events for specified computer groups. For each profile, you can select computer groups to monitor and rules that determine when an event occurs.

Events are generated when an endpoint experiences the conditions defined in an event rule in a profile.

When a profile targets an endpoint, tools are distributed to that endpoint to collect and monitor performance data. Data is collected every 15 seconds and stored for 15 days. This local data store is queried when you analyze events in Performance.

For example, you might want to know when available memory falls below a certain threshold on specific computers. You can create a profile with an Available Memory is less than 250 MB event rule and set the target for that profile to a computer group you want to monitor. When you analyze events in Performance, memory events are reported if any endpoints that you are targeting had less than 250 MB of available memory during the time frame (scope) that you selected for analysis.

The Events page shows charts that provide a high-level overview of events in the environment. You can also see a list of the specific endpoints that experienced a particular event (such as low memory) to identify and investigate issues in your environment. For more information, see Analyzing events.

Event rules

Event rules determine what conditions cause targeted endpoints to report events. Performance includes these event rules:

• Application Crashes
• Available Memory
• CPU Critical
• Disk Capacity
• Disk Latency
• System Crashes

You can select heuristics for some event rules. For example, if you add the Disk Latency event rule, you can monitor Read Latency or Write Latency. If either heuristic is reached, the event rule is triggered.

For more information, see Reference: Event rules.

Performance scores

Performance 1.14 and later includes performance scores to represent the health of the endpoints in your environment. Performance scores are an important metric when you evaluate the digital employee experience because the scores provide a comprehensive view of the performance of the endpoint devices that employees use to perform their work. For each endpoint, Performance calculates a performance score based on the number of events that occur on the endpoint. Use performance scores to identify endpoints with performance issues and to investigate causes for lower performing endpoints. You can then connect to individual endpoints through Tanium™ Direct Connect to troubleshoot issues.

Performance scores can help you to evaluate the employee experience by providing a comprehensive view of endpoint performance, which is a critical component of the digital employee experience. By monitoring the performance score over time, you can identify trends and patterns in endpoint performance, which enables you to proactively address issues before they become major problems. For example, if a performance score shows that there are frequent application crashes on a particular device, you can investigate the root cause of the issue and take steps to a resolution. By doing so, you can improve the digital employee experience and reduce the frustration and productivity loss associated with application crashes.

In addition, the performance score can help you evaluate the effectiveness of your technology investments and identify areas for improvement. For instance, if the performance score shows that endpoint performance is consistently low for a specific team or department, you can explore whether the employees in that area have the resources they need to do their jobs effectively.

Performance consolidates the performance scores for all endpoints so you can filter the scores by computer group.

To view and configure performance scores, your Tanium license must include Tanium Performance and Tanium™ Engage.

A performance score is a percentage between 1 and 100 that represents the health of the endpoint. The higher the number, the healthier the endpoint. Performance scores are based on events, which are grouped into categories to match the rule types described in Event rules. Performance scores are weighted by event category:

Default performance score weights by category

Event Category	Weight
Application Crashes	20%
Available Memory	10%
CPU Critical	10%
Disk Capacity	20%
Disk Latency	10%
System Crashes	30%

The weighted values add up to 100%.

The score for each event category is calculated based on the number of events in the category.

Score = 100 / (1 + Events)

The performance score is then calculated by adding the weighted category scores together:

Performance Score = (20% * Application Crashes score) +
                    (10% * Available Memory score) +
                    (10% * CPU Critical score) +
                    (20% * Disk Capacity score) +
                    (10% * Disk Latency score) +
                    (30% * System Crashes score)

For each profile, you can set the weight of each event category to customize the performance score calculation to your organization's specific needs and priorities. For example, system crashes and applications crashes can disrupt employee productivity, so you might consider weighting those two categories higher than the default weights. For information, see Create a profile.

Performance score ranges

Icon	Description	Range
	Good	76% to 100%
	Fair	51% to 75%
	Poor	26% to 50%
	Very Poor	1% to 25%

The Performance Overview page includes a Performance Score section where you can view and manage visualizations of endpoint health.

For information about viewing performance scores, see Monitoring performance scores.

Interoperability with other Tanium products

Performance works with other Tanium products to provide additional features and reporting.

API Gateway

Use API Gateway to access the Performance API. For information about what features are available through the API Gateway, see Tanium API Gateway User Guide: Schema reference.

Criticality

The Performance Overview page contains a chart with Average Endpoint Performance Score by Criticality.

Direct Connect

Use Direct Connect to view live and historical data on endpoints to troubleshoot issues. For more information, see Connecting directly to endpoints.

Engage

Engage is required to view performance scores in Performance.

Reporting

Performance contains dashboards and charts supplied by Reporting. For information, see Monitoring performance scores.