Carbon Black Cloud: Pagefile grows when or higher sensor is installed
search cancel

Carbon Black Cloud: Pagefile grows when or higher sensor is installed


Article ID: 285050


Updated On:


Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)


Pagefile.sys is seen to increase in size when 3.5.0.X and Higher sensor is installed


  • Carbon Black Cloud Sensor: and Higher Versions.
  • Microsoft Windows: All Supported Versions


The 3.5.0.X sensor has the identified issue of changing memory dump type from 'Automatic' to 'Complete' memory dump ().


Option 1:
  1. Put the sensor into Bypass mode
  2. Edit C:\Program Files\Confer\cfg.ini file  
  3. Add the following
  1. Change system dump settings to default (automatic memory dump)
    1. Go to Advanced System Settings > Advanced > Startup & Recovery >Settings > Write Debug Info
    2. Set to value to "Automatic"
    3. Click OK
  2. Reboot the endpoint to confirm memory dump settings are still set to automatic and that the disk space has been reclaimed.
Option 2:
  1. On install of sensor maintenance release or newer where the ability to configure this via a command line install is available.
    msiexec /q /i C:\xxxxx\installer_vista_win7_win8- 32-3.5.0.xxxx.msi /L* log.txt COMPANY_CODE=XYZ AUTO_CONFIG_MEM_DUMP=0

Additional Information

  • If the memory dump is set to complete, the OS has to allocate enough space in the pagefile to store the entire contents of memory which is 1 x RAM plus 275 MB