A description of the benefits of Tachyon Agent Historic Data Capture and how the data can be retrieved.

What is Tachyon Agent Historic Data Capture?

On Tachyon Windows Agent devices Tachyon continuously captures events, which enables Tachyon to capture all significant events as they happen. This should be contrasted with polling, which to a certain degree relies on luck to capture conditions that are brief enough to fall between polls. In this way Tachyon Agent Historic Data Capture compares with the Windows Task Manager or Perfmon. Tachyon captures the data to a compressed and encrypted database to ensure that it has a very low impact on device performance and security.

The type of data captured and is described below and the configuration options for each capture source are described in Agent Historic Data Capture configuration properties. There are product pack instructions for getting and setting these configuration options.

On this page:

What are the capture sources?

The table below lists the capture sources supported by the historic data capture feature, and on which OS they are supported.

Source Name


ARPARP cache entries - the Agent captures the results of cached IP address to physical address resolutionsv3.2n/an/an/a
DNSDNS queries - the Agent captures whenever a DNS address is resolvedv2.1v2.1n/an/a
ProcessProcess execution - the Agent captures whenever a process starts on the devicev2.1v2.1v2.1v2.1
ProcessStabilizationThe time taken for a process execution to be considered stable whenever a monitored process starts on the devicev3.2n/an/an/a

A daily summary of the launches and terminations of processes.

Process Usage capture is disabled by default because it can generate high disk I/O while capturing process usage, especially on virtual machine hosts with guests starting at the same time. This capture source is required by AppClarity when using the Tachyon Powered Inventory feature (Tachyon connector).

Software installs/uninstalls/presence - the Agent captures whenever software is installed/uninstalled, and also captures which software is present on a device

TCPOutbound TCP connections - the Agent captures whenever an outbound TCP connection is madev2.1v2.1v2.1n/a

A daily summary of all the logons and logoffs of users.

This capture source is required by the AppClarity Tachyon Powered Inventory feature (Tachyon connector).


How is the data managed?

The data is captured and stored to a local, encrypted persistent store and then periodically aggregated according to an ongoing daily, weekly, monthly window. This means that the data is held securely and the amount of data is minimized while still maintaining its usefulness.

How do I retrieve the data from the Tachyon Agent devices?

Tachyon provides a number of product pack instructions that will let you interrogate your Tachyon Agent devices for the data they hold.