Generate a HAR File for Tanium Troubleshooting

Created by Brent Henderson, Modified on Fri, 27 Mar at 2:10 PM by Brent Henderson

What is a HAR file?
A HAR (HTTP Archive) file is a JSON-formatted log of all network requests made by your browser during a session. Support uses HAR files to diagnose login failures, console errors, slow page loads, API timeouts, and other issues in the Tanium Console.

Privacy Notice: HAR files may contain session tokens, cookies, and authentication credentials. Do not share a HAR file publicly. Attach it only to your support ticket. Once the issue is resolved, delete your local copy.

Before You Start

Use the browser you experience the issue in; do not switch browsers before capturing.
Reproduce the issue in a single browser tab while recording. Avoid opening new tabs or navigating away.
Have your Tanium Console URL ready before beginning.
Clear your browser cache only if specifically instructed by support; cache contents may be contributing to the issue.

Google Chrome

Steps

Open Google Chrome and navigate to your Tanium Console URL.
Press F12 (Windows/Linux) or Cmd + Option + I (Mac) to open Developer Tools.
Click the Network tab.
Check the Preserve log checkbox. This ensures requests are not cleared during page navigations or redirects.
Click the red Record button (circle icon) if it is not already active. It should be red/recording before you proceed.
Optionally, click the Clear button (?) to remove any pre-existing entries so the capture is clean.
Reproduce the issue - for example: log in, navigate to the page, trigger the error, or perform the failing action.
Once you have reproduced the issue, right-click anywhere in the Network request list.
Select Save all as HAR with content.
Save the file to a known location (e.g., your Desktop). Name it descriptively, such as tanium-issue-chrome.har.
Attach the saved .har file to your support ticket.

Tip: If you also see console errors, click the Console tab, right-click the error output, and select Save as... to capture a console log as a companion file.

Microsoft Edge

Steps

Open Microsoft Edge and navigate to your Tanium Console URL.
Press F12 (Windows) or Cmd + Option + I (Mac) to open Developer Tools.
Click the Network tab.
Check the Preserve log checkbox to retain requests across page navigations.
Confirm the Record network log button (circle icon, top-left of the Network panel) is red/active. Click it if it is not.
Click the Clear button to remove any pre-existing entries.
Reproduce the issue in the console - perform the action or workflow that triggers the problem.
Once reproduced, click the Export HAR button (down-arrow icon) in the Network toolbar.
Save the file to a known location and name it descriptively, such as tanium-issue-edge.har.
Attach the saved .har file to your support ticket.

Note: Edge Developer Tools are visually similar to Chrome DevTools. If you don't see the Export HAR button, you can also right-click any request in the Network list and select Save all as HAR with content.

Mozilla Firefox

Steps

Open Mozilla Firefox and navigate to your Tanium Console URL.
Press F12 (Windows/Linux) or Cmd + Option + I (Mac) to open the Browser Toolbox.
Click the Network tab.
Check the Persist Logs checkbox (gear icon → Persist Logs, or look for the checkbox directly in the toolbar depending on your Firefox version). This prevents the log from clearing during navigation.
Confirm that recording is active; the toolbar should show a pause button, indicating the network log is recording.
Click the trash can icon to clear existing entries for a clean capture.
Reproduce the issue in the Tanium Console.
Once the issue has been reproduced, click the gear icon in the Network panel toolbar.
Select Save All As HAR.
Save the file to a known location. Name it descriptively, such as tanium-issue-firefox.har.
Attach the saved .har file to your support ticket.

Firefox version note: The location of "Save All As HAR" may vary slightly between Firefox versions. In older versions, it may appear under the Network panel's context menu (right-click a request). In current versions (Firefox 100+), it is in the gear menu.

Quick Reference: HAR Export by Browser

Browser	Open DevTools	Preserve Log	Export HAR
Chrome	`F12` or `Cmd+Opt+I`	Network tab → ✅ Preserve log	Right-click request list → Save all as HAR with content
Edge	`F12` or `Cmd+Opt+I`	Network tab → ✅ Preserve log	Export HAR button (↓) or right-click → Save all as HAR with content
Firefox	`F12` or `Cmd+Opt+I`	Gear icon → ✅ Persist Logs	Gear icon → Save All As HAR

What to Include in Your Support Ticket

Along with your HAR file, please include the following to help support investigate faster:

Tanium Console URL (e.g., https://yourcompany.tanium.cloud)
Browser and version: Help → About in your browser
Tanium version: Visible in the Console under Help → About)
Description of the issue: what you expected vs. what happened
Steps to reproduce: The exact sequence of actions that triggers the problem
Timestamp: When the issue occurred
Screenshots or screen recording (optional but helpful for UI errors)

Frequently Asked Questions

Do I need to be an administrator to generate a HAR file?

No. HAR file capture is a browser feature and does not require any special permissions in Tanium or on your endpoint.

Will capturing a HAR file affect my Tanium session?

No. Opening Developer Tools and recording network traffic is entirely passive. It does not modify, interrupt, or terminate your Tanium Console session.

My HAR file is very large - is that okay?

Large HAR files (50 MB+) are common in long sessions. If your ticketing system has file size limits, compress the HAR file using standard ZIP compression before attaching. If it still exceeds the limit, contact support for an alternate upload method.

I captured the HAR file but the issue didn't reproduce - what do I do?

Submit the HAR file anyway. Even a session without a visible error may contain useful diagnostic information (failed API calls, slow responses, redirect loops). Note in your ticket that the issue did not reproduce during capture.

Is a HAR file the same as a network trace (ETL/PCAP)?

No. A HAR file captures browser-layer HTTP/HTTPS requests only. If support needs a lower-level network trace, they will provide separate instructions for capturing an ETL (Windows) or PCAP file.