Carbon Black Cloud: High CPU utilization with the 2.7.x - 2.10.2.x sensors for Linux

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• High CPU utilization when sensors 2.7.x through 2.10.2.x installed
• The issue is likely to occur on a “busy” system with thousands of processes
• Issue is present even with sensor in bypass

Environment

• Endpoint Standard Sensor 2.7.x through 2.10.2.x sensors for Linux
• Linux: All Supported Versions

Cause

Defect in product related to the sensor's event tracking methodology.

Resolution

The issue has been resolved by optimizing the mechanism used by the sensor to keep track of processes.

Please upgrade to the 2.10.3.x sensor for Linux or greater.  VMWare Carbon Black also recommends testing prior to rolling out upgrades into production.