SQL Server Performance and Recovery Mode Issues

Products

• Carbon Black App Control

Issue/Introduction

SQL Servers experience a performance impact or going into recovery mode when the App Control agent is installed.

Environment

• App Control Server: All Versions
• App Control Agent: All Versions
• Microsoft SQL Server: All Supported Versions

Resolution

Step 1:Enable & Configure the Microsoft SQL Server Rapid Config

1. Log in to the Console and navigate to: Rules > Software Rules > Rapid Configs.
2. Locate Microsoft SQL Server in the list, click View Details (pencil icon) and verify:
   
   • Status: Enabled.
   • SQL Server Files to Ignore contains:

     *.ldf
     *.mdf
     *.ndf
     

   • Processes: is relevant for the SQL Server installation path:

     Default:
     <OnlyIf:RegKeyExists:HKLM\Software\Microsoft\Microsoft SQL Server>\Microsoft SQL Server\*
     
     Example Custom Install Path:
     <OnlyIf:RegKeyExists:HKLM\Software\Microsoft\Microsoft SQL Server>D:\Microsoft SQL Server\*
     

   • Applied to the relevant Policies.
3. Click Save & Exit.
4. Wait for the Agent to show as Connected & Up to Date and attempt to recreate the issue.

Step 2 (Optional): Enable Yara Exclusions

If the issue persists:

1. Log in to the Console and navigate to: https://ServerAddress/agent_config.php
2. Add a new Yara Exclusion and use the following details:
   • Name: SQL Server Yara Exclusion (or similar)
   • Host ID: <relevant SQL Server or 0 for all Hosts>
   • Value: Specify the mdf, ndf, and ldf files:

     yara_ignore_patterns=*.mdf,*.ldf,*.ndf

   • Macros: If desired, restrict only if the Microsoft SQL Server service exists

     <OnlyIf:ServiceName:*MSSQL*>

   • Platform: Windows
   • Status: Enabled
   • Create For: <relevant Policy where SQL Server expected>
3. Click Save
4. Wait for the Agent to show as Connected & Up to Date.
   Note: It may be necessary for the application server to be rebooted in order for the changes to take effect.

Step 3 (Optional): Enable Kernel Exclusions

If the issue still persists:

1. Log in to the Console and navigate to: https://ServerAddress/agent_config.php
2. Add a new Agent Config and use the following details:
   • Name: Ignore SQL File Ops (or similar)
   • Host ID: <relevant SQL Server or 0 for all Hosts>
   • Value: Specify the path to the mdf, ndf, and ldf files:
     

     kernelFileOpExclusions=*.mdf:8386431,*.ndf:8386431,*.ldf:8386431

   • Macros: If desired, restrict only if the Microsoft SQL Server service exists

     <OnlyIf:ServiceName:*MSSQL*>

   • Platform: Windows
   • Status: Enabled
   • Create For: <relevant Policy where SQL Server expected>
3. Click Save
4. Wait for the Agent to show as Connected & Up to Date.
   Note: It may be necessary for the application server to be rebooted in order for the changes to take effect.
5. Attempt to recreate the issue.

If the issue persists, collect the Agent Performance Logs with a Standard Procmon Capture and provide the results to Support.

Additional Information

• More details on Rapid Configs can be found in Tech Docs > Rules Installer and Rapid Configs
• Kernel Exclusions should always be a last resort.
  • The Kernel Exclusion above will instruct the Agent to ignore all file modifications.
  • Ignoring File Modifications for files that execute will cause performance issues and potential unexpected blocks.