Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance
search cancel

Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance

book

Article ID: 288587

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction


How to use ConfigProps to tune DFS path normalization performance delays

Environment

  • CB Defense Sensor: 3.5.0.1646+ and Higher
  • Microsoft Windows: All Supported Versions

Resolution

If you are experiencing delays when accessing files across a DFS network, enable the new heuristic changes (these two entries not needed for 3.6+ as they enabled by default) by adding / modifying the following in the cfg.ini using this KB:
SkipNetworkConversionToPhysical=0
OnlyAttemptDFSForPhysicalDeviceNames=1
Alternatively if a DFS file share stops functioning you can force DFS normalization by adding:
NormalizeAlwaysDFSPatterns=<path to server>

example: NormalizeAlwaysDFSPatterns=**servername**
Of if a non-DFS file share that is experiencing delays specify an ignore path to the server by adding:
NormalizeNeverDFSPatterns:<path to server> 

example: NormalizeNeverDFSPatterns=**servername**

Additional Information

Note: Using SkipNetworkConversionToPhysical=1 or OnlyAttemptDFSForPhysicalDeviceNames=1 in 3.5.0.1627 may cause a crash which will be addressed in the next release

  • New ConfigProp functionality has been added in 3.5.0.1627+ to help reduce DFS path normalization performance impact on network files path greater than four directories deep.
  • These changes can be added via cfg.ini in 3.5.0.1627+ or by using the Rules Management System when released.