EDR: Sensor_Registrations Table Grows To GB Sizes Within 3-5 Days

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor_registrations table in postgres grows into the GB sizes within 3-5 days.
• Vacuuming of sensor_registrations table only temporarily resolves the sizing.

Environment

• EDR Server: 7.1.1 and Higher

Cause

Number of concurrent connections to EDR Server is too high.

Resolution

1. Set the following configuration in /etc/cb/cb.conf: 

   SensorServicesWorkerConnections=5

2. Vacuum the sensor_registrations table in postgres: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-vacuum-sensor-related-Postgres-tables/ta-p/89869
3. Restart cb-enterprise services: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294

Additional Information

If setting the SensorServicesWorkerConnections configuration to 5 or lower does not resolve the issue, please contact Support for assistance in running the EDR Qualifier Tool.