CB Protection: Performance Delay in Fiserv Director Client

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Slower than average scanning time. 
• Overall slowness when opening different functions of the Director Client software. 

Environment

• Cb Protection Agent: All Supported Versions
• Fiserv Director Client

Cause

This is caused by the large number of operations that the Director Client makes. Each operation makes tens of thousands of calls which the Cb Protection Agent needs to analyze. 

Resolution

The resolution is adding a kernelProcessExclusions configuration for this application. It will reduce visibility on the software, but at the trade off, of better performance. 

1. Using the directions listed in the following article, add a new configuration property: https://community.carbonblack.com/t5/Knowledge-Base/Cb-Protection-Adding-an-Agent-Configuration-Property/ta-p/63990
2. Use the following values:
   • Property Name: Kernel Process Exclusion - Director Client
   • Host ID: Either 0 for all devices, or you can enter the host ID of a specific host. 
   • Status: Enabled
   • Value: kernelProcessExclusions=*\Program Files (x86)\Fiserv\Director\PDS1771\dirclt32.exe:99696

Additional Information

The value above 99696, is all file modification operations. Executions are still tracked.