Sharing Violation on Large Files due to agent analysis

Products

• Carbon Black App Control

Issue/Introduction

Procmon shows a sharing violation event where the duration column value is "60.99"

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

When the agent is analyzing a file, the kernel stalls opens from processes that would generate a sharing violation. This stall has a default maximum time limit of 61 seconds.

Resolution

1. Login to the App Control Console
2. Navigate in the URL bar to https://<YourServerNameHere>/agent_config.php
3. Find the configuration with value "kernelMaxParityAnalysisStallMs=61000"
4. Click edit and change this value from 61000 to 122000