EDR: Server Performance Issues Due to VM Missing vSphere Reserved Resources

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CPU spikes
• Memory spikes
• /var/log/messages reports multiple stack traces "Kdump: loaded Tainted:"

Environment

• EDR Servers: All within a VM
• vSphere Servers: All supported versions

Cause

Performance impact of EDR Server Virtual Machines due to CPU and memory contention.

Resolution

In vSphere Client, edit the EDR Server VM settings to reserve CPU and Memory according to the EDR OER.
1. Right click an EDR Server VM and select Edit Settings.
2. Under CPU, set a full CPU reservation.  If the VM was created with 12 vCPUs, then the reservation should be set to the number of vCPUs multiplied by the nominal frequency of the physical CPUs, e.g. for 2.2 GHz CPUs, the reservation should be 26.4 GHz.
3. Under Memory,  set a full memory reservation.  The memory reservation should equal the amount of assigned memory.  The check box "Reserve all guest memory" will keep those two values in lock.


 

Additional Information

• The resource reservations specify the guaranteed minimum allocation for a VM.
• Shares only provides a relative distribution of resources between sibling consumer (VMs and Resource Pools) when under contention.