High Memory usage on 4.0.0 sensors and Windows Servers

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Repmgr.exe process grows to 10-20 GB in size over a number of days.
• Problem can be temporarily fixed by restarting the CBC sensor or rebooting the machine.
• Problem may not occur in any 3.8.x or 3.9.x Windows sensor (a possible workaround).

Environment

• Carbon Black Cloud Windows Sensor: 4.0.0 and 4.0.1 versions
• Carbon Black Cloud Console: All versions
• Microsoft Windows Servers: All versions

Cause

• This is issue UAV-3193.
• This problem occurs when the KernelToUserBulkEventTransfer message-processor queue is under heavy load.

Resolution

The fix UAV-3193 in the 4.0.2 (MR 2) sensor will be to assign addition threads for the sensor to handle this.