EDR: Increased server side memory usage over time

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Memory warnings on the server/cluster machines
• Gunicorn processes related to Coreservices component consuming excessive memory on EDR server/cluster

Environment

• EDR 7.0 and higher

Cause

Slow memory leak in Coreservice component tracked as CB-33589
 

Resolution

1.  Edit /etc/cron.d/cb file on EDR Server (master/minions in case of cluster)
2.  Add the following lines just before the last line in the file ("# Cron requires that each entry in a crontab end in a newline.")

CentOS/RHEL 6.x:

#  CB-33589 workaround
0 23 * * * root /etc/init.d/cb-coreservices restart

CentOS/RHEL 7.x:

#  CB-33589 workaround
0 23 * * * root /bin/systemctl restart cb-coreservices

3.  Coreservices component will restart at 11pm nightly which addresses the underlying memory issue.