SQL Server Performance Issues With Agent Installed
search cancel

SQL Server Performance Issues With Agent Installed

book

Article ID: 286733

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

SQL Servers experience a performance impact when the App Control agent is installed.

Environment

  • App Control Server: All Versions
  • App Control Agent: All Versions
  • Microsoft SQL Server: All Supported Versions

Resolution

Step One: Enable & Configure the Microsoft SQL Server Rapid Config:

  1. Log in to the Console and navigate to: Rules > Software Rules > Rapid Configs.
  2. Locate Microsoft SQL Server in the list, click View Details (pencil icon) and verify:
    • Status is Enabled.
    • SQL Server Files to Ignore contains:
      • *.ldf
      • *.mdf
      • *.ndf
    • Applied to the relevant Policies.
  3. Click Save & Exit.
  4. Wait for the Agent to show as Connected & Up to Date and attempt to recreate the issue.

Step Two: If the issue persists, consider adding the following Kernel Exclusion:

  1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
  2. Add a new Agent Config and use the following details:
    • Name: Ignore SQL File Ops (or similar)
    • Host ID: <relevant SQL Server or 0 for all Hosts>
    • Value:
      kernelFileOpExclusions=*\path\to\*.mdf:8386431,*\path\to\*.ndf:8386431,*\path\to\*.ldf:8386431
    • Platform: Windows
    • Status: Enabled
    • Create For: <relevant Policy where SQL Server expected>
  3. Click Save
  4. Wait for the Agent to show as Connected & Up to Date.
    Note: It may be necessary for the application server to be rebooted in order for the changes to take effect.
  5. Attempt to recreate the issue.

Additional Information

  • More details on Rapid Configs can be found Server Documentation > Rules Installer Documentation on VMware Docs.
  • Kernel Exclusions should be a last resort.
  • The Kernel Exclusion above will instruct the Agent to ignore file modifications.
  • Ignoring File Modifications for files that execute will cause performance issues and potential unexpected blocks.