App Control: TMP Files Being Left Behind When Saved to a Fileshare
search cancel

App Control: TMP Files Being Left Behind When Saved to a Fileshare

book

Article ID: 286454

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Temporary files generated in a network share are not deleted when the application that generated them is closed.

Environment

  • App Control Agent: Version 8.1.x - 8.9.2
  • Microsoft Windows: All Supported Versions

Cause

Local analysis by the Agent on these renames is preventing remote operations from completing.

Resolution

This issue was tracked under EP-20242 and is resolved in combination of upgrading to Agent 8.9.4+ and creating the following Performance Optimization Rule.
  1. Upgrade the Agent on the file server to version 8.9.4 or higher.
  2. Log in to the Console and navigate to Rules > Software Rules > Custom.
  3. Click Add Custom Rule and use the following details:
    • Rule Name: Ignore TMP Renames On Fileserver (or something memorable)
    • Status: Enabled
    • Platform: Windows
    • Rule Type: Performance Optimization
    • Path or File:
      F:\Specific Path\To\Shared Files\*.tmp
    • Process: Any Process
    • Policies: Selected Policies > Specific Fileserver Policy
  4. Click Save & Exit

Additional Information

This Custom Rule could be locked down further with the use of a Hostname Macro in the Path or File, example:
<OnlyIf:Hostname:*FileServer0?>F:\Specific Path\To\Shared Files\*.tmp