App Control: Why is the cache.db-wal file very large?
search cancel

App Control: Why is the cache.db-wal file very large?

book

Article ID: 286535

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

It is observed that on a Linux endpoint, the cache.db-wal file may be quite larger than the cache.db file itself.

Environment

  • App Control Agent: All Versions
  • Linux: All Supported Versions

Cause

This is expected behavior.

Resolution

The WAL file is a temporary file used by SQLite and is automatically removed when the last connection to the database closes. When an Agent is installed and in a healthy state, this only happens when either:

Additional Information

This file is a rollback journal for an SQLite database, similar to a transaction log on Microsoft SQL. In the SQLite documentation db-wal files are defined: 
A write-ahead log or WAL file is used in place of a rollback journal when SQLite is operating in WAL mode. As with the rollback journal, the purpose of the WAL file is to implement atomic commit and rollback. 
The WAL file is always located in the same directory as the database file and has the same name as the database file except with the 4 characters "-wal" appended. 
The WAL file is created when the first connection to the database is opened and is normally removed when the last connection to the database closes. 
However, if the last connection does not shut down cleanly, the WAL file will remain in the filesystem and will be automatically cleaned up the next time the database is opened.