App Control: High Memory Usage by Linux Agent

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

App Control Agent is using large amounts of RAM.

Environment

• App Control Agent: All Supported Versions
• Linux Operating System: All Supported Versions

Cause

High volume of file activity for non-interesting files.

Resolution

Add following two Performance Optimization (PO) Rules to help reduce memory usage:

1. Ignore rsyslog writes:

a. Open the Console -> Software Rules -> Custom tab
b. Select 'Add Custom Rule'
c. Create new rule with following values:

Rule Name/Description: PO for rsyslog
Status: Enabled
Platform: Linux
Rule Type: Performance Optimization
Path or File: *
Process: */usr/sbin/rsyslogd

2. Ignore dracut writes:

a. Open the Console -> Software Rules -> Custom tab
b. Select 'Add Custom Rule'
c. Create new rule with following values:

Rule Name/Description: PO for dracut
Status: Enabled
Platform: Linux
Rule Type: Performance Optimization
Path or File: */var/tmp/dracut*
Process: *