App Control: HTTP 500 Error - Console Unavailable due to Agents Repeatedly Requesting "configlistwithdeleteditems"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Console Slow or unavailable with error message:

  HTTP Error 500 - Internal Server Error
  The FastCGI process has failed frequently recently

• Agents showing "Approvals out of date"
• IIS logs show the same agent IP address requesting the "configlistwithdeleteditems.xml.egk" repeatedly:

  2023-04-17 00:00:00 <ServerIP> GET /hostpkg/pkg.php pkg=configlistwithdeleteditems.xml.egk 443 - <AgentIP> Bit9+Parity - 503 4 4 78
  2023-04-17 00:00:00 <ServerIP> GET /hostpkg/pkg.php pkg=configlistwithdeleteditems.xml.egk 443 - <AgentIP> Bit9+Parity - 503 4 4 93
  2023-04-17 00:00:00 <ServerIP> GET /hostpkg/pkg.php pkg=configlistwithdeleteditems.xml.egk 443 - <AgentIP> Bit9+Parity - 500 0 64 32234
  2023-04-17 00:00:00 <ServerIP> GET /hostpkg/pkg.php pkg=configlistwithdeleteditems.xml.egk 443 - <AgentIP> Bit9+Parity - 500 0 64 32234

Environment

• App Control Console: All Supported Versions
• App Control Agent: 8.7.8 - 8.9.0

Cause

There is a bug that prevents agents from successfully importing the "configlistwithdeleteditems.xml.egk file, so they attempt the download from the IIS web server over and over again causing it to fail

Resolution

Upgrade the problematic Agents to Agent version 8.9.4 or apply the following workaround:

1. Log in to the Console and navigate to Assets > Computers > relevant Agent.
2. From the Computer Details page > right-hand menu > Other Actions > Delete database (this will cause the Agent to re-initialize)
3. Right menu options select > Other Actions > Restart service

Additional Information

This issue was tracked under EA-23003 and included in the fixes with Agent 8.9.2, however Agent 8.9.4 is recommended instead of 8.9.2.