SQL Server Performance Issues With Agent Installed

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

SQL Servers experience a performance impact when the App Control agent is installed.

Environment

• App Control Server: All Versions
• App Control Agent: All Versions
• Microsoft SQL Server: All Supported Versions

Resolution

Enable & Configure the Microsoft SQL Server Rapid Config

1. Log in to the Console and navigate to: Rules > Software Rules > Rapid Configs.
2. Locate Microsoft SQL Server in the list, click View Details (pencil icon) and verify:
   
   • Status: Enabled.
   • SQL Server Files to Ignore contains:

     *.ldf
     *.mdf
     *.ndf
     

   • Processes: is relevant for the SQL Server installation path:

     Default:
     <OnlyIf:RegKeyExists:HKLM\Software\Microsoft\Microsoft SQL Server>\Microsoft SQL Server\*
     
     Example Custom Install Path:
     <OnlyIf:RegKeyExists:HKLM\Software\Microsoft\Microsoft SQL Server>D:\Microsoft SQL Server\*
     

   • Applied to the relevant Policies.
3. Click Save & Exit.
4. Wait for the Agent to show as Connected & Up to Date and attempt to recreate the issue.

If the issue persists: Consider adding the following Kernel Exclusion

1. Log in to the Console and navigate to: https://ServerAddress/agent_config.php
2. Add a new Agent Config and use the following details:
   • Name: Ignore SQL File Ops (or similar)
   • Host ID: <relevant SQL Server or 0 for all Hosts>
   • Value:
     

     kernelFileOpExclusions=*\path\to\*.mdf:8386431,*\path\to\*.ndf:8386431,*\path\to\*.ldf:8386431

   • Platform: Windows
   • Status: Enabled
   • Create For: <relevant Policy where SQL Server expected>
3. Click Save
4. Wait for the Agent to show as Connected & Up to Date.
   Note: It may be necessary for the application server to be rebooted in order for the changes to take effect.
5. Attempt to recreate the issue.

If the issue persists, collect the Agent Performance Logs with a Standard Procmon Capture and provide the results to Support.

Additional Information

• More details on Rapid Configs can be found Server Documentation > Rules Installer Documentation on VMware Docs.
• Kernel Exclusions should be a last resort.
• The Kernel Exclusion above will instruct the Agent to ignore file modifications.
• Ignoring File Modifications for files that execute will cause performance issues and potential unexpected blocks.