Server Backlog Caused by .NET Activity

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Increased Server backlog shows that much of the activity is coming from .NET

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

.NET is generating a large number of new Files and Events for the Agent to track and report.

Resolution

Instruct the Agents to not to send Events related to .NET back to the Server, but to still scan and track related operations locally.

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Select the Property ABExclusionRules and change the Value accordingly: 
   • If a Value exists, copy & paste this to the end:

     |;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3

   • If a Value doesn't exist, copy & paste this:

     ;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3

3. Click Change to apply the new ABExclusion.

Additional Information

• ABExclusions are separated with the pipe character: |
• Trailing/Proceeding spaces are not supported in ABExclusions.