High Linux Agent Memory Usage and Large cache.db-Wal File

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

High memory usage and a large cache.db-wal file are observed on an endpoint with the Linux Agent installed. 

Environment

• App Control Agent: All Versions
• Linux: All Supported Versions

Cause

Growth of the db-wal file is expected, which can contribute to higher memory usage than normal by the Linux Agent.

Resolution

Resolving the immediate issue:

The WAL file is a temporary file used by SQLite and is automatically removed when the last connection to the database closes. When an Agent is installed and in a healthy state, this only happens when either:

• The endpoint is rebooted.
• The Agent is restarted.

Preventing future issues:

Reducing the speed at which the db-wal file grows may involve reducing the operations the Agent tracks:

• Upgrade the Agent to the latest version.
• Enable and configure the Linux System Performance Rapid Config.
• If necessary, additional steps are available in the Troubleshooting Agent Performance article.

Additional Information

This file is a rollback journal for an SQLite database, similar to a transaction log on Microsoft SQL. In the SQLite documentation db-wal files are defined: 

A write-ahead log or WAL file is used in place of a rollback journal when SQLite is operating in WAL mode. As with the rollback journal, the purpose of the WAL file is to implement atomic commit and rollback. 
The WAL file is always located in the same directory as the database file and has the same name as the database file except with the 4 characters "-wal" appended. 
The WAL file is created when the first connection to the database is opened and is normally removed when the last connection to the database closes. 
However, if the last connection does not shut down cleanly, the WAL file will remain in the filesystem and will be automatically cleaned up the next time the database is opened.