EDR: When Should High Memory Utilization By A Sensor Be Of Concern?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When should high memory utilization by a sensor be of concern?

Environment

• EDR Sensor: All Supported Versions

Resolution

There should be concern if the memory usage is so high an out-of-memory issue could occur, or if the user experience on the endpoint is impacted.

Additional Information

On busier systems (eg, Linux and server endpoints), memory utilization is going to go above the expected threshold to keep up with the events being generated on the endpoint, thus any memory-related health score messages can be ignored.