Troubleshoot endpoint performance using Exclusion Advisor Audit

EDRF Client 50.3 or later includes the Exclusion Advisor Audit diagnostic tool to identify the historical telemetry stored in events.db, trace.db, trace.log, and file_hash.db to rank most traced processes, files, folders, and rules.

The tool generates JSON reports that display high resource-consuming activities.

You can run the Exclusion Advisor Audit using the following methods:

• Command-line interface (CLI)

• Endpoint Security (HX)

• Minimum Escalation Report (MER) tool

Run an audit using the CLI

1. Log in the CLI as an administrator.

2. Locate the input script in the installation directory based on your audit scope.

   • Standard audit: exclusion_advisor_audit_defaults_script.json

   • Extended diagnostic audit: exclusion_advisor_audit_diagnostic_script.json

3. Define a writable output directory on the endpoint to save the JSON reports.

4. Use the following syntax to run the Exclusion Advisor Audit from the CLI:
   
   Syntax

    "<install_directory>\xclient.exe" -f "<path_to_input_script.json>" -o "<path_to_output_directory>" [-C <container_override>]

   Examples

   Eventor database

   "C:\Program Files\Trellix\XClient\xclient.exe" create -s "C:\Program Files\Trellix\XClient\exclusion_advisor_audit_defaults_script.json" -o "C:\ProgramData\Trellix\XClient\audit_output" -C mxa/container/Eventor/enabled=true

   Trace database

   "C:\Program Files\Trellix\XClient\xclient.exe" create -s "C:\Program Files\Trellix\XClient\exclusion_advisor_audit_diagnostic_script.json" -o "C:\ProgramData\Trellix\XClient\audit_output " -C mxa/container/Trace/enabled=true

Run an audit using Endpoint Security (HX)  

1. Log in to the Endpoint Security (HX) UI as an administrator.

2. Navigate to Hosts > All Hosts.

3. Select the target host.

4. On the Actions menu, select Agent Diagnostics.

5. On the Acquisitions page, wait for the task status to change to Acquired.

6. Select Download and save the diagnostic .zip package.

Run an audit using the MER tool

The MER tool collects any relevant log and system information and create an archive with all the information, which can be submitted to Trellix.

1. Download the MER tool.
   
   Alternatively, you can download from the ePO by navigating to Menu → Software Catalog → Utilities & Connectors → MER for ePO.

2. Run the MER tool on the targeted endpoint as an administrator. 

3. Extract the completed MER archive to a local folder.

Locate and navigate audit data in diagnostic packages

The diagnostics packages downloaded from the CLI, Endpoint Security (HX), or MER tool contain multiple diagnostic artifacts and log stores. Individual payload files use system-generated identifiers. Use the index file (manifest.json) to locate the target audit payload file (exclusion-advisor.json).

After you collect the audit payload, evaluate the telemetry metrics to apply targeted policy exclusions in ePO.

Diagnostic archive structure

• Index file (manifest.json): Located in the root directory of the extracted diagnostic package. It maps each diagnostic component to its payload identifier.

• Exclusion Advisor Audit file (exclusion-advisor.json): Identified within the index file under the Exclusion Advisor section. It contains raw telemetry, process start frequencies, disk I/O metrics, and noise summaries from endpoint databases (events.db, trace.db, trace.log,and file_hash.db).

Locate your output payload

Access the raw audit JSON payload based on your collection method:

• Command-line interface (CLI): Open the destination folder specified in the -o parameter to access the audit files.
  

• Endpoint security (HX) UI: Open the downloaded diagnostic .zip package. Use manifest.json to locate the associated audit payload file, or import the .zip archive into the EDRF Client Diagnostics Analyzer Tool.
  

• Minimum Escalation Report (MER) tool: Go to the <extracted_mer_folder>\XClient\XClient audit\exclusion advisor audit\>folder to access the audit files.

For more information about Exclusion Advisor Audit, see the Trellix Knowledge article, How to use Exclusion Advisor Audit to troubleshoot EDRF performance issues - 000015181.