App Control: System Health Alert "There Are Database Tables on Your Server That Are Extremely Close to Their Size Limit"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Many Computers reporting 'Approvals Out of Date' in Status column
• Alert received that a table is close to approaching the  ~2.15 billion (8.9 and below) or ~4.3 billion (8.10 and above) limit

Health indicator Alert: Database Table Limit - There Are Database Tables on Your Server That Are Extremely Close to Their Size Limit

Environment

• App Control Server: All Supported Versions
• App Control Agent:  All Supported Versions

Cause

• The 'das' database will stop functioning properly if one of the tables reaches the limit.
• This condition will also affect communication between the Server/Agent, resulting in the 'Approvals Out Of Date' status. 

Resolution

1. Upgrade to App Control Server 8.10 or Higher. Over the last several releases we've made many improvements to various tables within App Control. Including:
   • 8.7.0: The ability to reuse rows that have been pruned on the dbo.filenames and dbo.pathnames tables
   • 8.9.0: The ability to reuse rows on the dbo.antibodies table (EP-12544). Converted the antibody_groups_antibodies table to bigint (EP-13037).
   • 8.9.2: Improved the reuse row functionality (EP-16515)
   • 8.10.: Doubled the row capacity by adding the ability to use negative integers EP-18212). Converted alert_event_data to bigint (EP-17524)
2. If you've already upgraded or are unable to upgrade run the below queries and provide them to Support

   Query 1:
   select max(pathname_id) from dbo.pathnames with (nolock)
   
   Query 2:
   select count (*) from das.dbo.UnusedPathnames with (nolock)
   
   Query 3:
   select max(filename_id) from dbo.filenames with (nolock)
   
   Query 4:
   select count (*) from das.dbo.UnusedFilenames with (nolock)
   
   Query 5:
   select max(antibody_id) from das.dbo.antibodies with (nolock)
   
   Query 6:
   select count (*) from das.dbo.UnusedAntibodies with (nolock)