App Control: TMP Files Being Left Behind When Saved to a Fileshare
book
Article ID: 286454
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Temporary files generated in a network share are not deleted when the application that generated them is closed.
Environment
App Control Agent: Version 8.1.x - 8.9.2
Microsoft Windows: All Supported Versions
Cause
Local analysis by the Agent on these renames is preventing remote operations from completing.
Resolution
This issue was tracked under EP-20242 and is resolved in combination of upgrading to Agent 8.9.4+ and creating the following Performance Optimization Rule.
Upgrade the Agent on the file server to version 8.9.4 or higher.
Log in to the Console and navigate to Rules > Software Rules > Custom.
Click Add Custom Rule and use the following details:
Rule Name: Ignore TMP Renames On Fileserver (or something memorable)
Status: Enabled
Platform: Windows
Rule Type: Performance Optimization
Path or File:
F:\Specific Path\To\Shared Files\*.tmp
Process: Any Process
Policies: Selected Policies > Specific Fileserver Policy
Click Save & Exit
Additional Information
This Custom Rule could be locked down further with the use of a Hostname Macro in the Path or File, example: