High CPU and Performance Impact During Agent Initialization

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to reduce CPU and performance impacts during Agent Initialization.

Environment

• App Control Agent: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

• During Initialization the Agent is analyzing existing files on the endpoint.
• The Agent uses as much CPU as allowed by the operating system, to shorten the time to complete this process.
• Typically the initialization impact is temporary, and minimal, especially on solid state drives.

Resolution

To further minimize the performance impact the following steps should be taken:

1. Confirm all Antivirus Exclusions for the Agent are present.
   • Antivirus Exclusions for the Agent
2. Adjust the Initialization Priority to increase the Sleep Timer:
   1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
   2. Click Show Filters > Value > Contains > initialization_priority
   3. Click View Details (pencil icon) and adjust accordingly:
      • Status: Enabled
      • Value: initialization_priority=2
   4. Save the changes.
   5. Confirm the Agent shows as Connected & Up to Date for the new setting to be applied before moving out of Disabled.
      Warning: Do not adjust other Agent Configs without first consulting Support. Incorrect adjustments can cause the product to not function as intended
3. Ignore directories during Initialization containing large files that are not expected to execute.
   • Ignore Directory During Initialization

Additional Information

• If you are only seeing this on a single instance set the Host ID for the Sleep Timer to that specific Agent.
• The Agent calls Sleep between processing of files during the initialization. Default setting is 1. When set greater than 1, it sleeps for a small number of ms to allow more time for other processes, resulting in better performance.
• Setting this value higher increases the amount of time it takes for initialization to complete. Initialization is greatly dependent on environment and amount of files existing on the endpoint.
• This setting should only be adjusted if performance impact is seen.
• Descriptions for the possible Values are as follows:

  Value:                      Description:
  initialization_priority=0   (Fastest Initialization, Most CPU) 
  initialization_priority=1   (Default)
  initialization_priority=2   (Slower Initialization, Less CPU) 
  initialization_priority=3   (Slowest Initialization, Least CPU)