Cb Defense Sensor: Performance Issue Due to DB Corruption

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

    •   Machine becomes unusable, with high I/O and CPU utilization observed for CB Defense processes

    •   Confer.log shows repeated DbReadFileDb and DbGetRepSrcTable errors:

11/01/18 15:27:09: b00 DbReadFileDb: error executing SQL command: 11

11/01/18 15:27:09: b00 DbGetRepSrcTable: error executing SQL command (11)

Environment

• Cb Defense Sensor: 3.1.x - 3.3.x
• Windows: All Supported Versions

 

Cause

• DB corruptions like this can occur when a machine / sensor crashes or during power loss / hard resets
• This condition can persist through a sensor upgrade

Resolution

• Recommended procedure is to uninstall sensor completely and re-install
• There is a potential for the sensor reset action from with the UI can be used, however issue may persist
• The DB may be restored from the backup copy of the db_rep file (db_rep.safebkp) by putting the sensor in bypass, stopping the repmgr service, deleting db_rep and renaming the backup