Troubleshooting Console Slowness. Performance Issues, or High CPU Usage

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Steps to troubleshoot Console performance issues such as general slowness or page timeouts.
• Steps to troubleshoot consistent & prolonged high CPU usage by the App Control Server services (ParityServer.exe and or ParityReporter.exe)

Environment

• App Control Server: All Supported Versions

Resolution

1. Check for a recently updated Trusted Certificates
   • System Configuration page > Security tab > Scroll to the bottom > Trusted Communication Certificates table
   • Show Columns > Add the Date Modified column
   • Verify if any certificate was modified recently > If so, follow these steps to resolve
2. Does the slowness occur when the Console is accessed locally on the App Control server by going to: https://localhost/login.php
   • If not, this would indicate there may be a networking/DNS misconfiguration
   • Verify IPv6 is enabled (disabling it will negatively affect performance)
   • Add a record to the HOSTS file with the App Control Server name pointing to the local IPv4 and v6 (127.0.0.1, ::1)
3. If using Active Directory integration for Logins or Policy Mapping
   • Validate Policy Mappings are accurate/still used
     1. Rules > Policies > Mappings
     2. Verify Mappings are still accurate or needed
     3. Delete any Mappings that are no longer being used
     4. If no longer using Policy Mappings: Settings > System Configuration > General > Active Directory Integration > AD-Based Policy: Disabled
   • Validate User Role Mappings are accurate/still used
     1. Settings > Login Accounts > User Role Mappings
     2. Verify Mappings are still accurate or needed
     3. Delete any Mappings that are no longer being used
     4. If no longer using Role Mappings: Settings > System Configuration > General > Active Directory Integration > AD-Based Logins: Disabled
   • Verify deprecated AD Integration is not being used
     1. Navigate to https://ServerAddress/shepherd_config.php
     2. Locate the Property, AllowADScripts
     3. If true, change to false then restart the service, Carbon Black App Control Server
4. Verify SQL Server configuration
   • Complete the steps in Validating Storage Performance
   • Review Choosing Proper Hardware for the SQL Server
5. Verify App Control Server configuration
   • If not on Server 8.10.2 or higher, verify Private Memory restrictions
     1. Log in to the application server hosting the Console as the Carbon Black Service Account
     2. Launch IIS Manager (Start > inetmgr)
     3. From the left-hand pane expand the server name > select Application Pools > right click DefaultAppPool > Recycling
     4. Adjust the Private memory usage (in KB) to: 0 > click Next > Finish
     5. From the left-hand pane > select the server name
     6. From the right-hand pane > Actions > Restart
   • Choosing Proper Hardware for App Control Server
6. Review & verify 
   • Architecture by Endpoint Count
   • Common Performance Pitfalls
7. Determine if the slowness occurs on a specific page or query
   • The Filter: "contains" is a very taxing query
   • Consider reducing the timeframe for the query
   • The more specific and targeted the query, the faster the results will be
   • Consider utilizing Event Caching for complicated queries
8. Collect and review the IIS Logs for repeated file requests resulting in 500 or 503 errors
   • Web Console Unavailable Due to IIS 500/503 Errors