Endpoint Troubleshooting Home page, questions, and responses

How to frame questions in Endpoint Troubleshooting and view the responses.

Asking a question

Endpoint Troubleshooting is where you frame the questions that let you immediately explore the information available on connected devices.

The animation shows the TCNQuestioner01 user entering the URL used in our examples, https://tachyon.acme.local/Tachyon/App/#/Explorer

The animation shows the Endpoint Troubleshooting prompting for credentials only because the browser's security settings have been configured to prompt for username and password, which can be useful when testing.

Choosing your instruction

Clicking on the All Instructions button lets you browse through all the currently installed questions.

You can select to browse through the instructions using groups with the following options:

Group by	Description
Instruction set	This option groups instructions by the instruction set they belong to. You can click on an instruction set to expand and collapse a list of its instructions. An instruction can only belong to one instruction set.
None	This option lists all of the instructions without sets.

You can see the instruction type (question or action), name and description

The animation shows the following steps:

The user selects the All Instructions dialog for a 1E system which has had DEXPacks already added.

In the All instructions popup the user then takes a quick look through the available Instruction sets as selected in the Group by options.

You can expand each of the Instruction sets and select the instruction that you want to run. In our example the user expands the 1E TachyonCore set and then selects the How many of each operating system versions are installed? question.

Selecting the question loads it into Endpoint Troubleshooting You can see the text for the question loaded into the question box with its operational parameters laid out underneath.

• The following table briefly describes the available parameters:

Parameter	Description
Duration	Determines how long the data will be gathered for and how long to keep the answers for. Instructions have defaults for the number of minutes to gather data for and keep answers for. You can override either of these defaults.
Approximate Target	An estimation of how many devices will receive the question.
Projected Impact	An estimation of how much impact the question will have on the target devices. The estimate depends on previous occasions the instruction has run.
Options	Lists any additional options that have been set for the question.

To ask a question you just click the Ask this question button below the parameters. When a question is asked, the view automatically switches to its Responses page and provides immediate feedback on how the question responses are coming in. The Responses from value at the top-right of the page displays the number of devices that have responded. In our example all 12 devices respond.

The selected Instruction displays a response visualization chart and returns a list of responses. You can switch to the list by clicking the List view icon.

Interacting with a response visualization

Some questions provided in DEXPacks are defined so that their responses can be viewed as graphs.

In our example we want to know which processes have made the most connections to the Domain Controller for our example environment in the past 10 days. The question we will ask is: Which processes have made connection to <ipAddresss> in the last <numDays> days?. This question will return the information so that it can be reviewed as a graph. It also makes use of Client Activity Record, where potentially useful information about network and device performance is gathered and held by the 1E client.

The animation opposite shows the following steps of the example:

On the Endpoint Troubleshooting home page the TCNQuestioner01 user types the text which processes into the text box and then selects the Which processes have made connection to <ipAddress> in the last <numDays> days? question from the matching list.

They then set <ipAddress> to 100.100.100.100 (the IP address for the ACME Domain Controller) and <numDays> to 10.

Once the parameters are set they then click on the Ask this question button and the clients respond with the list of Process Names that have connected to that IP address.

You can interact with the charts, toggling the display for each individual process between on and off, by clicking on the name of the process displayed beneath the chart. In our example TCNQuestioner01 toggles the display of each process with the highest number of connections off to reveal the processes with less connections.

You can also investigate the individual data nodes of the graphs by hovering the mouse over the points. Here the user looks at each node in turn for ccmexec.exe.

Checking the status of responses using the summary tab

In the animation opposite we show how the Summary tab on the Responses page can be used to check the status for the responses to a question.

To check the Response page Summary tab we will run a Configuration Manager client health check question.

From the Tasks view navigate to Software Vendors→Microsoft→Configuration Manager

Select the What is the health of my SCCM clients? Check that inventory has run and that policy has been evaluated in the last <numdays> days. question.

Set <numdays> to 7 and click the Ask this Question button.

When the responses start coming in for the question, select the Summary tab to see how they are progressing.

On this page you will see some statistics related to the question responses and some charts that display the information graphically.

The Sent Count chart shows the total number of questions that have been sent and the balance between the responses that have been received and the awaiting responses. As each response comes in the percentage of Responses goes up and the Awaiting goes down. This is also seen in the actual values for the Responses count and Awaiting responses count.

The Responses Status chart shows the status for each response as it comes in. For each response the status may be one of the following:

Reponses	Description
Success	Devices that have responded with a success status
Success - no content	Devices that have responded with a success status but did not provide a response to the instruction content request
Error	Devices that have responded with an error encountered when attempting to run the instruction
Not implemented	Devices that have responded where the feature contained in the instruction is not implemented on the device
Response too large	Devices that have not been able to respond to the instruction content request because their response was too large

In our example, eventually the Responses count in the Percent Sent Count chart rises to 100% indicating that all the responses have been received now (for the devices currently connected).

We can now check on the Status tab to investigate the reasons for the response statuses we've seen.

Expanding the Not implemented row, we can see that our Linux device cannot run this instruction because it uses a PowerShell script that is not supported on this platform.

Expanding the Error row, we can see that one of our Windows 7 devices generated a PowerShell error.