Cbstats Timing Out on Heavily Utilized Systems

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Cbstats is observed timing out on servers under high utilization.  

• Possible errors seen in /var/log/cb/enterprise/enterprise.log

  ConnectionError: HTTPConnectionPool(host='ip', port=9000): Max retries exceeded with url: /cbfs/admin/statistics (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f94e59fc710>: Failed to establish a new connection: [Errno 111] Connection refused',))

  <err> cb.enterprise.base_task - Exception during DashboardStatisticsUpdate

  
   

Environment

• EDR Server: All Versions

Cause

Systems that have heavy load can timeout the calls for the statistics when the commit takes more than 5 seconds.

Resolution

• Resolution requires 7.2.0 Server or Higher
  1. Edit /etc/cb/cb.conf
  2. Enter the following value with the amount of seconds

     SolrLukeRequestTimeoutSec=

  3. Restart services. How to restart server services

Additional Information

• Example for 20 second timeout

  SolrLukeRequestTimeoutSec=20